1 /*- 2 * SPDX-License-Identifier: (BSD-2-Clause AND ISC) 3 * 4 * Copyright (c) 2002 Michael Shalayeff 5 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 21 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 23 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 27 * THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /*- 31 * Copyright (c) 2009 David Gwynne <dlg@openbsd.org> 32 * 33 * Permission to use, copy, modify, and distribute this software for any 34 * purpose with or without fee is hereby granted, provided that the above 35 * copyright notice and this permission notice appear in all copies. 36 * 37 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 38 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 39 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 40 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 41 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 42 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 43 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 44 */ 45 46 /* 47 * $OpenBSD: if_pfsync.c,v 1.110 2009/02/24 05:39:19 dlg Exp $ 48 * 49 * Revisions picked from OpenBSD after revision 1.110 import: 50 * 1.119 - don't m_copydata() beyond the len of mbuf in pfsync_input() 51 * 1.118, 1.124, 1.148, 1.149, 1.151, 1.171 - fixes to bulk updates 52 * 1.120, 1.175 - use monotonic time_uptime 53 * 1.122 - reduce number of updates for non-TCP sessions 54 * 1.125, 1.127 - rewrite merge or stale processing 55 * 1.128 - cleanups 56 * 1.146 - bzero() mbuf before sparsely filling it with data 57 * 1.170 - SIOCSIFMTU checks 58 * 1.126, 1.142 - deferred packets processing 59 * 1.173 - correct expire time processing 60 */ 61 62 #include <sys/cdefs.h> 63 #include "opt_inet.h" 64 #include "opt_inet6.h" 65 #include "opt_pf.h" 66 67 #include <sys/param.h> 68 #include <sys/bus.h> 69 #include <sys/endian.h> 70 #include <sys/interrupt.h> 71 #include <sys/kernel.h> 72 #include <sys/lock.h> 73 #include <sys/mbuf.h> 74 #include <sys/module.h> 75 #include <sys/mutex.h> 76 #include <sys/nv.h> 77 #include <sys/priv.h> 78 #include <sys/smp.h> 79 #include <sys/socket.h> 80 #include <sys/sockio.h> 81 #include <sys/sysctl.h> 82 #include <sys/syslog.h> 83 84 #include <net/bpf.h> 85 #include <net/if.h> 86 #include <net/if_var.h> 87 #include <net/if_clone.h> 88 #include <net/if_private.h> 89 #include <net/if_types.h> 90 #include <net/vnet.h> 91 #include <net/pfvar.h> 92 #include <net/route.h> 93 #include <net/if_pfsync.h> 94 95 #include <netinet/if_ether.h> 96 #include <netinet/in.h> 97 #include <netinet/in_var.h> 98 #include <netinet6/in6_var.h> 99 #include <netinet/ip.h> 100 #include <netinet/ip6.h> 101 #include <netinet/ip_carp.h> 102 #include <netinet/ip_var.h> 103 #include <netinet/tcp.h> 104 #include <netinet/tcp_fsm.h> 105 #include <netinet/tcp_seq.h> 106 107 #include <netinet/ip6.h> 108 #include <netinet6/ip6_var.h> 109 #include <netinet6/scope6_var.h> 110 111 #include <netpfil/pf/pfsync_nv.h> 112 113 struct pfsync_bucket; 114 struct pfsync_softc; 115 116 union inet_template { 117 struct ip ipv4; 118 struct ip6_hdr ipv6; 119 }; 120 121 #define PFSYNC_MINPKT ( \ 122 sizeof(union inet_template) + \ 123 sizeof(struct pfsync_header) + \ 124 sizeof(struct pfsync_subheader) ) 125 126 static int pfsync_upd_tcp(struct pf_kstate *, struct pf_state_peer_export *, 127 struct pf_state_peer_export *); 128 static int pfsync_in_clr(struct mbuf *, int, int, int, int); 129 static int pfsync_in_ins(struct mbuf *, int, int, int, int); 130 static int pfsync_in_iack(struct mbuf *, int, int, int, int); 131 static int pfsync_in_upd(struct mbuf *, int, int, int, int); 132 static int pfsync_in_upd_c(struct mbuf *, int, int, int, int); 133 static int pfsync_in_ureq(struct mbuf *, int, int, int, int); 134 static int pfsync_in_del_c(struct mbuf *, int, int, int, int); 135 static int pfsync_in_bus(struct mbuf *, int, int, int, int); 136 static int pfsync_in_tdb(struct mbuf *, int, int, int, int); 137 static int pfsync_in_eof(struct mbuf *, int, int, int, int); 138 static int pfsync_in_error(struct mbuf *, int, int, int, int); 139 140 static int (*pfsync_acts[])(struct mbuf *, int, int, int, int) = { 141 pfsync_in_clr, /* PFSYNC_ACT_CLR */ 142 pfsync_in_ins, /* PFSYNC_ACT_INS_1301 */ 143 pfsync_in_iack, /* PFSYNC_ACT_INS_ACK */ 144 pfsync_in_upd, /* PFSYNC_ACT_UPD_1301 */ 145 pfsync_in_upd_c, /* PFSYNC_ACT_UPD_C */ 146 pfsync_in_ureq, /* PFSYNC_ACT_UPD_REQ */ 147 pfsync_in_error, /* PFSYNC_ACT_DEL */ 148 pfsync_in_del_c, /* PFSYNC_ACT_DEL_C */ 149 pfsync_in_error, /* PFSYNC_ACT_INS_F */ 150 pfsync_in_error, /* PFSYNC_ACT_DEL_F */ 151 pfsync_in_bus, /* PFSYNC_ACT_BUS */ 152 pfsync_in_tdb, /* PFSYNC_ACT_TDB */ 153 pfsync_in_eof, /* PFSYNC_ACT_EOF */ 154 pfsync_in_ins, /* PFSYNC_ACT_INS_1400 */ 155 pfsync_in_upd, /* PFSYNC_ACT_UPD_1400 */ 156 pfsync_in_ins, /* PFSYNC_ACT_INS_1500 */ 157 pfsync_in_upd, /* PFSYNC_ACT_UPD_1500 */ 158 }; 159 160 struct pfsync_q { 161 void (*write)(struct pf_kstate *, void *); 162 size_t len; 163 u_int8_t action; 164 }; 165 166 /* We have the following sync queues */ 167 enum pfsync_q_id { 168 PFSYNC_Q_INS_1301, 169 PFSYNC_Q_INS_1400, 170 PFSYNC_Q_INS_1500, 171 PFSYNC_Q_IACK, 172 PFSYNC_Q_UPD_1301, 173 PFSYNC_Q_UPD_1400, 174 PFSYNC_Q_UPD_1500, 175 PFSYNC_Q_UPD_C, 176 PFSYNC_Q_DEL_C, 177 PFSYNC_Q_COUNT, 178 }; 179 180 /* Functions for building messages for given queue */ 181 static void pfsync_out_state_1301(struct pf_kstate *, void *); 182 static void pfsync_out_state_1400(struct pf_kstate *, void *); 183 static void pfsync_out_state_1500(struct pf_kstate *, void *); 184 static void pfsync_out_iack(struct pf_kstate *, void *); 185 static void pfsync_out_upd_c(struct pf_kstate *, void *); 186 static void pfsync_out_del_c(struct pf_kstate *, void *); 187 188 /* Attach those functions to queue */ 189 static struct pfsync_q pfsync_qs[] = { 190 { pfsync_out_state_1301, sizeof(struct pfsync_state_1301), PFSYNC_ACT_INS_1301 }, 191 { pfsync_out_state_1400, sizeof(struct pfsync_state_1400), PFSYNC_ACT_INS_1400 }, 192 { pfsync_out_state_1500, sizeof(struct pfsync_state_1500), PFSYNC_ACT_INS_1500 }, 193 { pfsync_out_iack, sizeof(struct pfsync_ins_ack), PFSYNC_ACT_INS_ACK }, 194 { pfsync_out_state_1301, sizeof(struct pfsync_state_1301), PFSYNC_ACT_UPD_1301 }, 195 { pfsync_out_state_1400, sizeof(struct pfsync_state_1400), PFSYNC_ACT_UPD_1400 }, 196 { pfsync_out_state_1500, sizeof(struct pfsync_state_1500), PFSYNC_ACT_UPD_1500 }, 197 { pfsync_out_upd_c, sizeof(struct pfsync_upd_c), PFSYNC_ACT_UPD_C }, 198 { pfsync_out_del_c, sizeof(struct pfsync_del_c), PFSYNC_ACT_DEL_C } 199 }; 200 201 /* Map queue to pf_kstate->sync_state */ 202 static u_int8_t pfsync_qid_sstate[] = { 203 PFSYNC_S_INS, /* PFSYNC_Q_INS_1301 */ 204 PFSYNC_S_INS, /* PFSYNC_Q_INS_1400 */ 205 PFSYNC_S_INS, /* PFSYNC_Q_INS_1500 */ 206 PFSYNC_S_IACK, /* PFSYNC_Q_IACK */ 207 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1301 */ 208 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1400 */ 209 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1500 */ 210 PFSYNC_S_UPD_C, /* PFSYNC_Q_UPD_C */ 211 PFSYNC_S_DEL_C, /* PFSYNC_Q_DEL_C */ 212 }; 213 214 /* Map pf_kstate->sync_state to queue */ 215 static enum pfsync_q_id pfsync_sstate_to_qid(u_int8_t); 216 217 static void pfsync_q_ins(struct pf_kstate *, int sync_state, bool); 218 static void pfsync_q_del(struct pf_kstate *, bool, struct pfsync_bucket *); 219 220 static void pfsync_update_state(struct pf_kstate *); 221 static void pfsync_tx(struct pfsync_softc *, struct mbuf *); 222 223 struct pfsync_upd_req_item { 224 TAILQ_ENTRY(pfsync_upd_req_item) ur_entry; 225 struct pfsync_upd_req ur_msg; 226 }; 227 228 struct pfsync_deferral { 229 struct pfsync_softc *pd_sc; 230 TAILQ_ENTRY(pfsync_deferral) pd_entry; 231 struct callout pd_tmo; 232 233 struct pf_kstate *pd_st; 234 struct mbuf *pd_m; 235 }; 236 237 struct pfsync_bucket 238 { 239 int b_id; 240 struct pfsync_softc *b_sc; 241 struct mtx b_mtx; 242 struct callout b_tmo; 243 int b_flags; 244 #define PFSYNCF_BUCKET_PUSH 0x00000001 245 246 size_t b_len; 247 TAILQ_HEAD(, pf_kstate) b_qs[PFSYNC_Q_COUNT]; 248 TAILQ_HEAD(, pfsync_upd_req_item) b_upd_req_list; 249 TAILQ_HEAD(, pfsync_deferral) b_deferrals; 250 u_int b_deferred; 251 uint8_t *b_plus; 252 size_t b_pluslen; 253 254 struct ifaltq b_snd; 255 }; 256 257 struct pfsync_softc { 258 /* Configuration */ 259 struct ifnet *sc_ifp; 260 struct ifnet *sc_sync_if; 261 struct ip_moptions sc_imo; 262 struct ip6_moptions sc_im6o; 263 struct sockaddr_storage sc_sync_peer; 264 uint32_t sc_flags; 265 uint8_t sc_maxupdates; 266 union inet_template sc_template; 267 struct mtx sc_mtx; 268 uint32_t sc_version; 269 270 /* Queued data */ 271 struct pfsync_bucket *sc_buckets; 272 273 /* Bulk update info */ 274 struct mtx sc_bulk_mtx; 275 uint32_t sc_ureq_sent; 276 int sc_bulk_tries; 277 uint32_t sc_ureq_received; 278 int sc_bulk_hashid; 279 uint64_t sc_bulk_stateid; 280 uint32_t sc_bulk_creatorid; 281 struct callout sc_bulk_tmo; 282 struct callout sc_bulkfail_tmo; 283 }; 284 285 #define PFSYNC_LOCK(sc) mtx_lock(&(sc)->sc_mtx) 286 #define PFSYNC_UNLOCK(sc) mtx_unlock(&(sc)->sc_mtx) 287 #define PFSYNC_LOCK_ASSERT(sc) mtx_assert(&(sc)->sc_mtx, MA_OWNED) 288 289 #define PFSYNC_BUCKET_LOCK(b) mtx_lock(&(b)->b_mtx) 290 #define PFSYNC_BUCKET_UNLOCK(b) mtx_unlock(&(b)->b_mtx) 291 #define PFSYNC_BUCKET_LOCK_ASSERT(b) mtx_assert(&(b)->b_mtx, MA_OWNED) 292 293 #define PFSYNC_BLOCK(sc) mtx_lock(&(sc)->sc_bulk_mtx) 294 #define PFSYNC_BUNLOCK(sc) mtx_unlock(&(sc)->sc_bulk_mtx) 295 #define PFSYNC_BLOCK_ASSERT(sc) mtx_assert(&(sc)->sc_bulk_mtx, MA_OWNED) 296 297 #define PFSYNC_DEFER_TIMEOUT 20 298 299 static const char pfsyncname[] = "pfsync"; 300 static MALLOC_DEFINE(M_PFSYNC, pfsyncname, "pfsync(4) data"); 301 VNET_DEFINE_STATIC(struct pfsync_softc *, pfsyncif) = NULL; 302 #define V_pfsyncif VNET(pfsyncif) 303 VNET_DEFINE_STATIC(void *, pfsync_swi_cookie) = NULL; 304 #define V_pfsync_swi_cookie VNET(pfsync_swi_cookie) 305 VNET_DEFINE_STATIC(struct intr_event *, pfsync_swi_ie); 306 #define V_pfsync_swi_ie VNET(pfsync_swi_ie) 307 VNET_DEFINE_STATIC(struct pfsyncstats, pfsyncstats); 308 #define V_pfsyncstats VNET(pfsyncstats) 309 VNET_DEFINE_STATIC(int, pfsync_carp_adj) = CARP_MAXSKEW; 310 #define V_pfsync_carp_adj VNET(pfsync_carp_adj) 311 VNET_DEFINE_STATIC(unsigned int, pfsync_defer_timeout) = PFSYNC_DEFER_TIMEOUT; 312 #define V_pfsync_defer_timeout VNET(pfsync_defer_timeout) 313 314 static void pfsync_timeout(void *); 315 static void pfsync_push(struct pfsync_bucket *); 316 static void pfsync_push_all(struct pfsync_softc *); 317 static void pfsyncintr(void *); 318 static int pfsync_multicast_setup(struct pfsync_softc *, struct ifnet *, 319 struct in_mfilter *, struct in6_mfilter *); 320 static void pfsync_multicast_cleanup(struct pfsync_softc *); 321 static void pfsync_pointers_init(void); 322 static void pfsync_pointers_uninit(void); 323 static int pfsync_init(void); 324 static void pfsync_uninit(void); 325 326 static unsigned long pfsync_buckets; 327 328 SYSCTL_NODE(_net, OID_AUTO, pfsync, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 329 "PFSYNC"); 330 SYSCTL_STRUCT(_net_pfsync, OID_AUTO, stats, CTLFLAG_VNET | CTLFLAG_RW, 331 &VNET_NAME(pfsyncstats), pfsyncstats, 332 "PFSYNC statistics (struct pfsyncstats, net/if_pfsync.h)"); 333 SYSCTL_INT(_net_pfsync, OID_AUTO, carp_demotion_factor, CTLFLAG_VNET | CTLFLAG_RW, 334 &VNET_NAME(pfsync_carp_adj), 0, "pfsync's CARP demotion factor adjustment"); 335 SYSCTL_ULONG(_net_pfsync, OID_AUTO, pfsync_buckets, CTLFLAG_RDTUN, 336 &pfsync_buckets, 0, "Number of pfsync hash buckets"); 337 SYSCTL_UINT(_net_pfsync, OID_AUTO, defer_delay, CTLFLAG_VNET | CTLFLAG_RW, 338 &VNET_NAME(pfsync_defer_timeout), 0, "Deferred packet timeout (in ms)"); 339 340 static int pfsync_clone_create(struct if_clone *, int, caddr_t); 341 static void pfsync_clone_destroy(struct ifnet *); 342 static int pfsync_alloc_scrub_memory(struct pf_state_peer_export *, 343 struct pf_state_peer *); 344 static int pfsyncoutput(struct ifnet *, struct mbuf *, 345 const struct sockaddr *, struct route *); 346 static int pfsyncioctl(struct ifnet *, u_long, caddr_t); 347 348 static int pfsync_defer(struct pf_kstate *, struct mbuf *); 349 static void pfsync_undefer(struct pfsync_deferral *, int); 350 static void pfsync_undefer_state_locked(struct pf_kstate *, int); 351 static void pfsync_undefer_state(struct pf_kstate *, int); 352 static void pfsync_defer_tmo(void *); 353 354 static void pfsync_request_update(u_int32_t, u_int64_t); 355 static bool pfsync_update_state_req(struct pf_kstate *); 356 357 static void pfsync_drop_all(struct pfsync_softc *); 358 static void pfsync_drop(struct pfsync_softc *, int); 359 static void pfsync_sendout(int, int); 360 static void pfsync_send_plus(void *, size_t); 361 362 static void pfsync_bulk_start(void); 363 static void pfsync_bulk_status(u_int8_t); 364 static void pfsync_bulk_update(void *); 365 static void pfsync_bulk_fail(void *); 366 367 static void pfsync_detach_ifnet(struct ifnet *); 368 369 static int pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *, 370 struct pfsync_kstatus *); 371 static int pfsync_kstatus_to_softc(struct pfsync_kstatus *, 372 struct pfsync_softc *); 373 374 #ifdef IPSEC 375 static void pfsync_update_net_tdb(struct pfsync_tdb *); 376 #endif 377 static struct pfsync_bucket *pfsync_get_bucket(struct pfsync_softc *, 378 struct pf_kstate *); 379 380 #define PFSYNC_MAX_BULKTRIES 12 381 382 VNET_DEFINE(struct if_clone *, pfsync_cloner); 383 #define V_pfsync_cloner VNET(pfsync_cloner) 384 385 const struct in6_addr in6addr_linklocal_pfsync_group = 386 {{{ 0xff, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 387 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0 }}}; 388 static int 389 pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param) 390 { 391 struct pfsync_softc *sc; 392 struct ifnet *ifp; 393 struct pfsync_bucket *b; 394 int c; 395 enum pfsync_q_id q; 396 397 if (unit != 0) 398 return (EINVAL); 399 400 if (! pfsync_buckets) 401 pfsync_buckets = mp_ncpus * 2; 402 403 sc = malloc(sizeof(struct pfsync_softc), M_PFSYNC, M_WAITOK | M_ZERO); 404 sc->sc_flags |= PFSYNCF_OK; 405 sc->sc_maxupdates = 128; 406 sc->sc_version = PFSYNC_MSG_VERSION_DEFAULT; 407 sc->sc_buckets = mallocarray(pfsync_buckets, sizeof(*sc->sc_buckets), 408 M_PFSYNC, M_ZERO | M_WAITOK); 409 for (c = 0; c < pfsync_buckets; c++) { 410 b = &sc->sc_buckets[c]; 411 mtx_init(&b->b_mtx, "pfsync bucket", NULL, MTX_DEF); 412 413 b->b_id = c; 414 b->b_sc = sc; 415 b->b_len = PFSYNC_MINPKT; 416 417 for (q = 0; q < PFSYNC_Q_COUNT; q++) 418 TAILQ_INIT(&b->b_qs[q]); 419 420 TAILQ_INIT(&b->b_upd_req_list); 421 TAILQ_INIT(&b->b_deferrals); 422 423 callout_init(&b->b_tmo, 1); 424 425 b->b_snd.ifq_maxlen = ifqmaxlen; 426 } 427 428 ifp = sc->sc_ifp = if_alloc(IFT_PFSYNC); 429 if_initname(ifp, pfsyncname, unit); 430 ifp->if_softc = sc; 431 ifp->if_ioctl = pfsyncioctl; 432 ifp->if_output = pfsyncoutput; 433 ifp->if_hdrlen = sizeof(struct pfsync_header); 434 ifp->if_mtu = ETHERMTU; 435 mtx_init(&sc->sc_mtx, pfsyncname, NULL, MTX_DEF); 436 mtx_init(&sc->sc_bulk_mtx, "pfsync bulk", NULL, MTX_DEF); 437 callout_init_mtx(&sc->sc_bulk_tmo, &sc->sc_bulk_mtx, 0); 438 callout_init_mtx(&sc->sc_bulkfail_tmo, &sc->sc_bulk_mtx, 0); 439 440 if_attach(ifp); 441 442 bpfattach(ifp, DLT_PFSYNC, PFSYNC_HDRLEN); 443 444 V_pfsyncif = sc; 445 446 return (0); 447 } 448 449 static void 450 pfsync_clone_destroy(struct ifnet *ifp) 451 { 452 struct pfsync_softc *sc = ifp->if_softc; 453 struct pfsync_bucket *b; 454 int c, ret; 455 456 for (c = 0; c < pfsync_buckets; c++) { 457 b = &sc->sc_buckets[c]; 458 /* 459 * At this stage, everything should have already been 460 * cleared by pfsync_uninit(), and we have only to 461 * drain callouts. 462 */ 463 PFSYNC_BUCKET_LOCK(b); 464 while (b->b_deferred > 0) { 465 struct pfsync_deferral *pd = 466 TAILQ_FIRST(&b->b_deferrals); 467 468 ret = callout_stop(&pd->pd_tmo); 469 if (ret > 0) { 470 pfsync_undefer(pd, 1); 471 } else { 472 PFSYNC_BUCKET_UNLOCK(b); 473 callout_drain(&pd->pd_tmo); 474 PFSYNC_BUCKET_LOCK(b); 475 } 476 } 477 MPASS(b->b_deferred == 0); 478 MPASS(TAILQ_EMPTY(&b->b_deferrals)); 479 PFSYNC_BUCKET_UNLOCK(b); 480 481 free(b->b_plus, M_PFSYNC); 482 b->b_plus = NULL; 483 b->b_pluslen = 0; 484 485 callout_drain(&b->b_tmo); 486 } 487 488 callout_drain(&sc->sc_bulkfail_tmo); 489 callout_drain(&sc->sc_bulk_tmo); 490 491 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p) 492 (*carp_demote_adj_p)(-V_pfsync_carp_adj, "pfsync destroy"); 493 bpfdetach(ifp); 494 if_detach(ifp); 495 496 pfsync_drop_all(sc); 497 498 if_free(ifp); 499 pfsync_multicast_cleanup(sc); 500 mtx_destroy(&sc->sc_mtx); 501 mtx_destroy(&sc->sc_bulk_mtx); 502 503 for (c = 0; c < pfsync_buckets; c++) { 504 b = &sc->sc_buckets[c]; 505 mtx_destroy(&b->b_mtx); 506 } 507 free(sc->sc_buckets, M_PFSYNC); 508 free(sc, M_PFSYNC); 509 510 V_pfsyncif = NULL; 511 } 512 513 static int 514 pfsync_alloc_scrub_memory(struct pf_state_peer_export *s, 515 struct pf_state_peer *d) 516 { 517 if (s->scrub.scrub_flag && d->scrub == NULL) { 518 d->scrub = uma_zalloc(V_pf_state_scrub_z, M_NOWAIT | M_ZERO); 519 if (d->scrub == NULL) 520 return (ENOMEM); 521 } 522 523 return (0); 524 } 525 526 static int 527 pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version) 528 { 529 struct pfsync_softc *sc = V_pfsyncif; 530 #ifndef __NO_STRICT_ALIGNMENT 531 struct pfsync_state_key key[2]; 532 #endif 533 struct pfsync_state_key *kw, *ks; 534 struct pf_kstate *st = NULL; 535 struct pf_state_key *skw = NULL, *sks = NULL; 536 struct pf_krule *r = NULL; 537 struct pfi_kkif *kif, *orig_kif; 538 struct pfi_kkif *rt_kif = NULL; 539 struct pf_kpooladdr *rpool_first; 540 int error; 541 int n = 0; 542 sa_family_t rt_af = 0; 543 uint8_t rt = 0; 544 sa_family_t wire_af, stack_af; 545 u_int8_t wire_proto, stack_proto; 546 547 PF_RULES_RASSERT(); 548 549 if (strnlen(sp->pfs_1301.ifname, IFNAMSIZ) == IFNAMSIZ) 550 return (EINVAL); 551 552 if (sp->pfs_1301.creatorid == 0) { 553 if (V_pf_status.debug >= PF_DEBUG_MISC) 554 printf("%s: invalid creator id: %08x\n", __func__, 555 ntohl(sp->pfs_1301.creatorid)); 556 return (EINVAL); 557 } 558 559 /* 560 * Check interfaces early on. Do it before allocating memory etc. 561 * Because there is a high chance there will be a lot more such states. 562 */ 563 if ((kif = orig_kif = pfi_kkif_find(sp->pfs_1301.ifname)) == NULL) { 564 if (V_pf_status.debug >= PF_DEBUG_MISC) 565 printf("%s: unknown interface: %s\n", __func__, 566 sp->pfs_1301.ifname); 567 if (flags & PFSYNC_SI_IOCTL) 568 return (EINVAL); 569 return (0); /* skip this state */ 570 } 571 572 /* 573 * States created with floating interface policy can be synchronized to 574 * hosts with different interfaces, because they are bound to V_pfi_all. 575 * But s->orig_kif still points to a real interface. Don't abort 576 * importing the state if orig_kif does not exists on the importing host 577 * but the state is not interface-bound. 578 */ 579 if (msg_version == PFSYNC_MSG_VERSION_1500) { 580 orig_kif = pfi_kkif_find(sp->pfs_1500.orig_ifname); 581 if (orig_kif == NULL) { 582 if (kif == V_pfi_all) { 583 orig_kif = kif; 584 } else { 585 if (V_pf_status.debug >= PF_DEBUG_MISC) 586 printf("%s: unknown original interface:" 587 " %s\n", __func__, 588 sp->pfs_1500.orig_ifname); 589 if (flags & PFSYNC_SI_IOCTL) 590 return (EINVAL); 591 return (0); /* skip this state */ 592 } 593 } 594 } 595 596 /* 597 * If the ruleset checksums match or the state is coming from the ioctl, 598 * it's safe to associate the state with the rule of that number. 599 */ 600 if (sp->pfs_1301.rule != htonl(-1) && sp->pfs_1301.anchor == htonl(-1) && 601 (flags & (PFSYNC_SI_IOCTL | PFSYNC_SI_CKSUM)) && ntohl(sp->pfs_1301.rule) < 602 pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount) { 603 TAILQ_FOREACH(r, pf_main_ruleset.rules[ 604 PF_RULESET_FILTER].active.ptr, entries) 605 if (ntohl(sp->pfs_1301.rule) == n++) 606 break; 607 } else 608 r = &V_pf_default_rule; 609 610 switch (msg_version) { 611 case PFSYNC_MSG_VERSION_1301: 612 /* 613 * On FreeBSD <= 13 the routing interface and routing operation 614 * are not sent over pfsync. If the ruleset is identical, 615 * though, we might be able to recover the routing information 616 * from the local ruleset. 617 */ 618 if (r != &V_pf_default_rule) { 619 struct pf_kpool *pool = &r->route; 620 621 /* Backwards compatibility. */ 622 if (TAILQ_EMPTY(&pool->list)) 623 pool = &r->rdr; 624 625 /* 626 * The ruleset is identical, try to recover. If the rule 627 * has a redirection pool with a single interface, there 628 * is a chance that this interface is identical as on 629 * the pfsync peer. If there's more than one interface, 630 * give up, as we can't be sure that we will pick the 631 * same one as the pfsync peer did. 632 */ 633 rpool_first = TAILQ_FIRST(&(pool->list)); 634 if ((rpool_first == NULL) || 635 (TAILQ_NEXT(rpool_first, entries) != NULL)) { 636 DPFPRINTF(PF_DEBUG_MISC, 637 "%s: can't recover routing information " 638 "because of empty or bad redirection pool", 639 __func__); 640 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0); 641 } 642 rt = r->rt; 643 rt_kif = rpool_first->kif; 644 /* 645 * Guess the AF of the route address, FreeBSD 13 does 646 * not support af-to nor prefer-ipv6-nexthop 647 * so it should be safe. 648 */ 649 rt_af = r->af; 650 } else if (!PF_AZERO(&sp->pfs_1301.rt_addr, sp->pfs_1301.af)) { 651 /* 652 * Ruleset different, routing *supposedly* requested, 653 * give up on recovering. 654 */ 655 DPFPRINTF(PF_DEBUG_MISC, 656 "%s: can't recover routing information " 657 "because of different ruleset", __func__); 658 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0); 659 } 660 wire_af = stack_af = sp->pfs_1301.af; 661 wire_proto = stack_proto = sp->pfs_1301.proto; 662 break; 663 case PFSYNC_MSG_VERSION_1400: 664 /* 665 * On FreeBSD 14 we're not taking any chances. 666 * We use the information synced to us. 667 */ 668 if (sp->pfs_1400.rt) { 669 rt_kif = pfi_kkif_find(sp->pfs_1400.rt_ifname); 670 if (rt_kif == NULL) { 671 DPFPRINTF(PF_DEBUG_MISC, 672 "%s: unknown route interface: %s", 673 __func__, sp->pfs_1400.rt_ifname); 674 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0); 675 } 676 rt = sp->pfs_1400.rt; 677 /* 678 * Guess the AF of the route address, FreeBSD 14 does 679 * not support af-to nor prefer-ipv6-nexthop 680 * so it should be safe. 681 */ 682 rt_af = sp->pfs_1400.af; 683 } 684 wire_af = stack_af = sp->pfs_1400.af; 685 wire_proto = stack_proto = sp->pfs_1400.proto; 686 break; 687 case PFSYNC_MSG_VERSION_1500: 688 /* 689 * On FreeBSD 15 and above we're not taking any chances. 690 * We use the information synced to us. 691 */ 692 if (sp->pfs_1500.rt) { 693 rt_kif = pfi_kkif_find(sp->pfs_1500.rt_ifname); 694 if (rt_kif == NULL) { 695 DPFPRINTF(PF_DEBUG_MISC, 696 "%s: unknown route interface: %s", 697 __func__, sp->pfs_1500.rt_ifname); 698 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0); 699 } 700 rt = sp->pfs_1500.rt; 701 rt_af = sp->pfs_1500.rt_af; 702 } 703 wire_af = sp->pfs_1500.wire_af; 704 stack_af = sp->pfs_1500.stack_af; 705 wire_proto = sp->pfs_1500.wire_proto; 706 stack_proto = sp->pfs_1500.stack_proto; 707 break; 708 } 709 710 if ((r->max_states && 711 counter_u64_fetch(r->states_cur) >= r->max_states)) 712 goto cleanup; 713 714 /* 715 * XXXGL: consider M_WAITOK in ioctl path after. 716 */ 717 st = pf_alloc_state(M_NOWAIT); 718 if (__predict_false(st == NULL)) 719 goto cleanup; 720 721 if ((skw = uma_zalloc(V_pf_state_key_z, M_NOWAIT)) == NULL) 722 goto cleanup; 723 724 #ifndef __NO_STRICT_ALIGNMENT 725 bcopy(&sp->pfs_1301.key, key, sizeof(struct pfsync_state_key) * 2); 726 kw = &key[PF_SK_WIRE]; 727 ks = &key[PF_SK_STACK]; 728 #else 729 kw = &sp->pfs_1301.key[PF_SK_WIRE]; 730 ks = &sp->pfs_1301.key[PF_SK_STACK]; 731 #endif 732 733 if (wire_af != stack_af || 734 PF_ANEQ(&kw->addr[0], &ks->addr[0], wire_af) || 735 PF_ANEQ(&kw->addr[1], &ks->addr[1], wire_af) || 736 kw->port[0] != ks->port[0] || 737 kw->port[1] != ks->port[1]) { 738 sks = uma_zalloc(V_pf_state_key_z, M_NOWAIT); 739 if (sks == NULL) 740 goto cleanup; 741 } else 742 sks = skw; 743 744 /* allocate memory for scrub info */ 745 if (pfsync_alloc_scrub_memory(&sp->pfs_1301.src, &st->src) || 746 pfsync_alloc_scrub_memory(&sp->pfs_1301.dst, &st->dst)) 747 goto cleanup; 748 749 /* Copy to state key(s). */ 750 skw->addr[0] = kw->addr[0]; 751 skw->addr[1] = kw->addr[1]; 752 skw->port[0] = kw->port[0]; 753 skw->port[1] = kw->port[1]; 754 skw->proto = wire_proto; 755 skw->af = wire_af; 756 if (sks != skw) { 757 sks->addr[0] = ks->addr[0]; 758 sks->addr[1] = ks->addr[1]; 759 sks->port[0] = ks->port[0]; 760 sks->port[1] = ks->port[1]; 761 sks->proto = stack_proto; 762 sks->af = stack_af; 763 } 764 765 /* copy to state */ 766 st->creation = (time_uptime - ntohl(sp->pfs_1301.creation)) * 1000; 767 st->act.rt = rt; 768 st->act.rt_kif = rt_kif; 769 st->act.rt_af = rt_af; 770 771 switch (msg_version) { 772 case PFSYNC_MSG_VERSION_1301: 773 st->state_flags = sp->pfs_1301.state_flags; 774 st->direction = sp->pfs_1301.direction; 775 st->act.log = sp->pfs_1301.log; 776 st->timeout = sp->pfs_1301.timeout; 777 if (rt) 778 bcopy(&sp->pfs_1301.rt_addr, &st->act.rt_addr, 779 sizeof(st->act.rt_addr)); 780 /* 781 * In FreeBSD 13 pfsync lacks many attributes. Copy them 782 * from the rule if possible. If rule can't be matched 783 * clear any set options as we can't recover their 784 * parameters. 785 */ 786 if (r == &V_pf_default_rule) { 787 st->state_flags &= ~PFSTATE_SETMASK; 788 } else { 789 /* 790 * Similar to pf_rule_to_actions(). This code 791 * won't set the actions properly if they come 792 * from multiple "match" rules as only rule 793 * creating the state is send over pfsync. 794 */ 795 st->act.qid = r->qid; 796 st->act.pqid = r->pqid; 797 st->act.rtableid = r->rtableid; 798 if (r->scrub_flags & PFSTATE_SETTOS) 799 st->act.set_tos = r->set_tos; 800 st->act.min_ttl = r->min_ttl; 801 st->act.max_mss = r->max_mss; 802 st->state_flags |= (r->scrub_flags & 803 (PFSTATE_NODF|PFSTATE_RANDOMID| 804 PFSTATE_SETTOS|PFSTATE_SCRUB_TCP| 805 PFSTATE_SETPRIO)); 806 if (r->dnpipe || r->dnrpipe) { 807 if (r->free_flags & PFRULE_DN_IS_PIPE) 808 st->state_flags |= PFSTATE_DN_IS_PIPE; 809 else 810 st->state_flags &= ~PFSTATE_DN_IS_PIPE; 811 } 812 st->act.dnpipe = r->dnpipe; 813 st->act.dnrpipe = r->dnrpipe; 814 } 815 break; 816 case PFSYNC_MSG_VERSION_1400: 817 st->state_flags = ntohs(sp->pfs_1400.state_flags); 818 st->direction = sp->pfs_1400.direction; 819 st->act.log = sp->pfs_1400.log; 820 st->timeout = sp->pfs_1400.timeout; 821 st->act.qid = ntohs(sp->pfs_1400.qid); 822 st->act.pqid = ntohs(sp->pfs_1400.pqid); 823 st->act.dnpipe = ntohs(sp->pfs_1400.dnpipe); 824 st->act.dnrpipe = ntohs(sp->pfs_1400.dnrpipe); 825 st->act.rtableid = ntohl(sp->pfs_1400.rtableid); 826 st->act.min_ttl = sp->pfs_1400.min_ttl; 827 st->act.set_tos = sp->pfs_1400.set_tos; 828 st->act.max_mss = ntohs(sp->pfs_1400.max_mss); 829 st->act.set_prio[0] = sp->pfs_1400.set_prio[0]; 830 st->act.set_prio[1] = sp->pfs_1400.set_prio[1]; 831 if (rt) 832 bcopy(&sp->pfs_1400.rt_addr, &st->act.rt_addr, 833 sizeof(st->act.rt_addr)); 834 break; 835 case PFSYNC_MSG_VERSION_1500: 836 st->state_flags = ntohs(sp->pfs_1500.state_flags); 837 st->direction = sp->pfs_1500.direction; 838 st->act.log = sp->pfs_1500.log; 839 st->timeout = sp->pfs_1500.timeout; 840 st->act.qid = ntohs(sp->pfs_1500.qid); 841 st->act.pqid = ntohs(sp->pfs_1500.pqid); 842 st->act.dnpipe = ntohs(sp->pfs_1500.dnpipe); 843 st->act.dnrpipe = ntohs(sp->pfs_1500.dnrpipe); 844 st->act.rtableid = ntohl(sp->pfs_1500.rtableid); 845 st->act.min_ttl = sp->pfs_1500.min_ttl; 846 st->act.set_tos = sp->pfs_1500.set_tos; 847 st->act.max_mss = ntohs(sp->pfs_1500.max_mss); 848 st->act.set_prio[0] = sp->pfs_1500.set_prio[0]; 849 st->act.set_prio[1] = sp->pfs_1500.set_prio[1]; 850 if (rt) 851 bcopy(&sp->pfs_1500.rt_addr, &st->act.rt_addr, 852 sizeof(st->act.rt_addr)); 853 if (sp->pfs_1500.tagname[0] != 0) 854 st->tag = pf_tagname2tag(sp->pfs_1500.tagname); 855 break; 856 default: 857 panic("%s: Unsupported pfsync_msg_version %d", 858 __func__, msg_version); 859 } 860 861 st->expire = pf_get_uptime(); 862 if (sp->pfs_1301.expire) { 863 uint32_t timeout; 864 timeout = r->timeout[st->timeout]; 865 if (!timeout) 866 timeout = V_pf_default_rule.timeout[st->timeout]; 867 868 /* sp->expire may have been adaptively scaled by export. */ 869 st->expire -= (timeout - ntohl(sp->pfs_1301.expire)) * 1000; 870 } 871 872 if (! (st->act.rtableid == -1 || 873 (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs))) 874 goto cleanup; 875 876 if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) { 877 if (V_pf_status.debug >= PF_DEBUG_MISC) 878 printf("%s: invalid SCTP state from creator id: %08x\n", __func__, 879 ntohl(sp->pfs_1301.creatorid)); 880 goto cleanup; 881 } 882 883 st->id = sp->pfs_1301.id; 884 st->creatorid = sp->pfs_1301.creatorid; 885 pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src); 886 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst); 887 888 st->rule = r; 889 st->nat_rule = NULL; 890 st->anchor = NULL; 891 892 st->pfsync_time = time_uptime; 893 st->sync_state = PFSYNC_S_NONE; 894 895 if (!(flags & PFSYNC_SI_IOCTL)) 896 st->state_flags |= PFSTATE_NOSYNC; 897 898 if ((error = pf_state_insert(kif, orig_kif, skw, sks, st)) != 0) 899 goto cleanup_state; 900 901 /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */ 902 counter_u64_add(r->states_cur, 1); 903 counter_u64_add(r->states_tot, 1); 904 905 if (!(flags & PFSYNC_SI_IOCTL)) { 906 st->state_flags &= ~PFSTATE_NOSYNC; 907 if (st->state_flags & PFSTATE_ACK) { 908 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 909 PFSYNC_BUCKET_LOCK(b); 910 pfsync_q_ins(st, PFSYNC_S_IACK, true); 911 PFSYNC_BUCKET_UNLOCK(b); 912 913 pfsync_push_all(sc); 914 } 915 } 916 st->state_flags &= ~PFSTATE_ACK; 917 PF_STATE_UNLOCK(st); 918 919 return (0); 920 921 cleanup: 922 error = ENOMEM; 923 924 if (skw == sks) 925 sks = NULL; 926 uma_zfree(V_pf_state_key_z, skw); 927 uma_zfree(V_pf_state_key_z, sks); 928 929 cleanup_state: /* pf_state_insert() frees the state keys. */ 930 if (st) { 931 st->timeout = PFTM_UNLINKED; /* appease an assert */ 932 pf_free_state(st); 933 } 934 return (error); 935 } 936 937 #ifdef INET 938 static int 939 pfsync_input(struct mbuf **mp, int *offp __unused, int proto __unused) 940 { 941 struct pfsync_softc *sc = V_pfsyncif; 942 struct mbuf *m = *mp; 943 struct ip *ip = mtod(m, struct ip *); 944 struct pfsync_header *ph; 945 struct pfsync_subheader subh; 946 947 int offset, len, flags = 0; 948 int rv; 949 uint16_t count; 950 951 PF_RULES_RLOCK_TRACKER; 952 953 *mp = NULL; 954 V_pfsyncstats.pfsyncs_ipackets++; 955 956 /* Verify that we have a sync interface configured. */ 957 if (!sc || !sc->sc_sync_if || !V_pf_status.running || 958 (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) 959 goto done; 960 961 /* verify that the packet came in on the right interface */ 962 if (sc->sc_sync_if != m->m_pkthdr.rcvif) { 963 V_pfsyncstats.pfsyncs_badif++; 964 goto done; 965 } 966 967 if_inc_counter(sc->sc_ifp, IFCOUNTER_IPACKETS, 1); 968 if_inc_counter(sc->sc_ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len); 969 /* verify that the IP TTL is 255. */ 970 if (ip->ip_ttl != PFSYNC_DFLTTL) { 971 V_pfsyncstats.pfsyncs_badttl++; 972 goto done; 973 } 974 975 offset = ip->ip_hl << 2; 976 if (m->m_pkthdr.len < offset + sizeof(*ph)) { 977 V_pfsyncstats.pfsyncs_hdrops++; 978 goto done; 979 } 980 981 if (offset + sizeof(*ph) > m->m_len) { 982 if (m_pullup(m, offset + sizeof(*ph)) == NULL) { 983 V_pfsyncstats.pfsyncs_hdrops++; 984 return (IPPROTO_DONE); 985 } 986 ip = mtod(m, struct ip *); 987 } 988 ph = (struct pfsync_header *)((char *)ip + offset); 989 990 /* verify the version */ 991 if (ph->version != PFSYNC_VERSION) { 992 V_pfsyncstats.pfsyncs_badver++; 993 goto done; 994 } 995 996 len = ntohs(ph->len) + offset; 997 if (m->m_pkthdr.len < len) { 998 V_pfsyncstats.pfsyncs_badlen++; 999 goto done; 1000 } 1001 1002 /* 1003 * Trusting pf_chksum during packet processing, as well as seeking 1004 * in interface name tree, require holding PF_RULES_RLOCK(). 1005 */ 1006 PF_RULES_RLOCK(); 1007 if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH)) 1008 flags = PFSYNC_SI_CKSUM; 1009 1010 offset += sizeof(*ph); 1011 while (offset <= len - sizeof(subh)) { 1012 m_copydata(m, offset, sizeof(subh), (caddr_t)&subh); 1013 offset += sizeof(subh); 1014 1015 if (subh.action >= PFSYNC_ACT_MAX) { 1016 V_pfsyncstats.pfsyncs_badact++; 1017 PF_RULES_RUNLOCK(); 1018 goto done; 1019 } 1020 1021 count = ntohs(subh.count); 1022 V_pfsyncstats.pfsyncs_iacts[subh.action] += count; 1023 rv = (*pfsync_acts[subh.action])(m, offset, count, flags, subh.action); 1024 if (rv == -1) { 1025 PF_RULES_RUNLOCK(); 1026 return (IPPROTO_DONE); 1027 } 1028 1029 offset += rv; 1030 } 1031 PF_RULES_RUNLOCK(); 1032 1033 done: 1034 m_freem(m); 1035 return (IPPROTO_DONE); 1036 } 1037 #endif 1038 1039 #ifdef INET6 1040 static int 1041 pfsync6_input(struct mbuf **mp, int *offp __unused, int proto __unused) 1042 { 1043 struct pfsync_softc *sc = V_pfsyncif; 1044 struct mbuf *m = *mp; 1045 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); 1046 struct pfsync_header *ph; 1047 struct pfsync_subheader subh; 1048 1049 int offset, len, flags = 0; 1050 int rv; 1051 uint16_t count; 1052 1053 PF_RULES_RLOCK_TRACKER; 1054 1055 *mp = NULL; 1056 V_pfsyncstats.pfsyncs_ipackets++; 1057 1058 /* Verify that we have a sync interface configured. */ 1059 if (!sc || !sc->sc_sync_if || !V_pf_status.running || 1060 (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) 1061 goto done; 1062 1063 /* verify that the packet came in on the right interface */ 1064 if (sc->sc_sync_if != m->m_pkthdr.rcvif) { 1065 V_pfsyncstats.pfsyncs_badif++; 1066 goto done; 1067 } 1068 1069 if_inc_counter(sc->sc_ifp, IFCOUNTER_IPACKETS, 1); 1070 if_inc_counter(sc->sc_ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len); 1071 /* verify that the IP TTL is 255. */ 1072 if (ip6->ip6_hlim != PFSYNC_DFLTTL) { 1073 V_pfsyncstats.pfsyncs_badttl++; 1074 goto done; 1075 } 1076 1077 1078 offset = sizeof(*ip6); 1079 if (m->m_pkthdr.len < offset + sizeof(*ph)) { 1080 V_pfsyncstats.pfsyncs_hdrops++; 1081 goto done; 1082 } 1083 1084 if (offset + sizeof(*ph) > m->m_len) { 1085 if (m_pullup(m, offset + sizeof(*ph)) == NULL) { 1086 V_pfsyncstats.pfsyncs_hdrops++; 1087 return (IPPROTO_DONE); 1088 } 1089 ip6 = mtod(m, struct ip6_hdr *); 1090 } 1091 ph = (struct pfsync_header *)((char *)ip6 + offset); 1092 1093 /* verify the version */ 1094 if (ph->version != PFSYNC_VERSION) { 1095 V_pfsyncstats.pfsyncs_badver++; 1096 goto done; 1097 } 1098 1099 len = ntohs(ph->len) + offset; 1100 if (m->m_pkthdr.len < len) { 1101 V_pfsyncstats.pfsyncs_badlen++; 1102 goto done; 1103 } 1104 1105 /* 1106 * Trusting pf_chksum during packet processing, as well as seeking 1107 * in interface name tree, require holding PF_RULES_RLOCK(). 1108 */ 1109 PF_RULES_RLOCK(); 1110 if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH)) 1111 flags = PFSYNC_SI_CKSUM; 1112 1113 offset += sizeof(*ph); 1114 while (offset <= len - sizeof(subh)) { 1115 m_copydata(m, offset, sizeof(subh), (caddr_t)&subh); 1116 offset += sizeof(subh); 1117 1118 if (subh.action >= PFSYNC_ACT_MAX) { 1119 V_pfsyncstats.pfsyncs_badact++; 1120 PF_RULES_RUNLOCK(); 1121 goto done; 1122 } 1123 1124 count = ntohs(subh.count); 1125 V_pfsyncstats.pfsyncs_iacts[subh.action] += count; 1126 rv = (*pfsync_acts[subh.action])(m, offset, count, flags, subh.action); 1127 if (rv == -1) { 1128 PF_RULES_RUNLOCK(); 1129 return (IPPROTO_DONE); 1130 } 1131 1132 offset += rv; 1133 } 1134 PF_RULES_RUNLOCK(); 1135 1136 done: 1137 m_freem(m); 1138 return (IPPROTO_DONE); 1139 } 1140 #endif 1141 1142 static int 1143 pfsync_in_clr(struct mbuf *m, int offset, int count, int flags, int action) 1144 { 1145 struct pfsync_clr *clr; 1146 struct pfi_kkif *kif = NULL; 1147 struct mbuf *mp; 1148 int len = sizeof(*clr) * count; 1149 int i, offp; 1150 u_int32_t creatorid; 1151 1152 mp = m_pulldown(m, offset, len, &offp); 1153 if (mp == NULL) { 1154 V_pfsyncstats.pfsyncs_badlen++; 1155 return (-1); 1156 } 1157 clr = (struct pfsync_clr *)(mp->m_data + offp); 1158 1159 for (i = 0; i < count; i++) { 1160 creatorid = clr[i].creatorid; 1161 1162 if (clr[i].ifname[0] != '\0' && 1163 (kif = pfi_kkif_find(clr[i].ifname)) == NULL) 1164 continue; 1165 1166 for (int i = 0; i <= V_pf_hashmask; i++) { 1167 struct pf_idhash *ih = &V_pf_idhash[i]; 1168 struct pf_kstate *s; 1169 relock: 1170 PF_HASHROW_LOCK(ih); 1171 LIST_FOREACH(s, &ih->states, entry) { 1172 if (s->creatorid != creatorid) 1173 continue; 1174 if (kif != NULL && kif != s->kif) 1175 continue; 1176 1177 s->state_flags |= PFSTATE_NOSYNC; 1178 pf_remove_state(s); 1179 goto relock; 1180 } 1181 PF_HASHROW_UNLOCK(ih); 1182 } 1183 } 1184 1185 return (len); 1186 } 1187 1188 static int 1189 pfsync_in_ins(struct mbuf *m, int offset, int count, int flags, int action) 1190 { 1191 struct mbuf *mp; 1192 union pfsync_state_union *sa, *sp; 1193 int i, offp, total_len, msg_version, msg_len; 1194 u_int8_t timeout, direction; 1195 sa_family_t af; 1196 1197 switch (action) { 1198 case PFSYNC_ACT_INS_1301: 1199 msg_len = sizeof(struct pfsync_state_1301); 1200 msg_version = PFSYNC_MSG_VERSION_1301; 1201 break; 1202 case PFSYNC_ACT_INS_1400: 1203 msg_len = sizeof(struct pfsync_state_1400); 1204 msg_version = PFSYNC_MSG_VERSION_1400; 1205 break; 1206 case PFSYNC_ACT_INS_1500: 1207 msg_len = sizeof(struct pfsync_state_1500); 1208 msg_version = PFSYNC_MSG_VERSION_1500; 1209 break; 1210 default: 1211 V_pfsyncstats.pfsyncs_badver++; 1212 return (-1); 1213 } 1214 1215 total_len = msg_len * count; 1216 1217 mp = m_pulldown(m, offset, total_len, &offp); 1218 if (mp == NULL) { 1219 V_pfsyncstats.pfsyncs_badlen++; 1220 return (-1); 1221 } 1222 sa = (union pfsync_state_union *)(mp->m_data + offp); 1223 1224 for (i = 0; i < count; i++) { 1225 sp = (union pfsync_state_union *)((char *)sa + msg_len * i); 1226 1227 switch (msg_version) { 1228 case PFSYNC_MSG_VERSION_1301: 1229 case PFSYNC_MSG_VERSION_1400: 1230 af = sp->pfs_1301.af; 1231 timeout = sp->pfs_1301.timeout; 1232 direction = sp->pfs_1301.direction; 1233 break; 1234 case PFSYNC_MSG_VERSION_1500: 1235 af = sp->pfs_1500.wire_af; 1236 timeout = sp->pfs_1500.timeout; 1237 direction = sp->pfs_1500.direction; 1238 break; 1239 } 1240 1241 /* Check for invalid values. */ 1242 if (timeout >= PFTM_MAX || 1243 sp->pfs_1301.src.state > PF_TCPS_PROXY_DST || 1244 sp->pfs_1301.dst.state > PF_TCPS_PROXY_DST || 1245 direction > PF_OUT || 1246 (af != AF_INET && af != AF_INET6)) { 1247 if (V_pf_status.debug >= PF_DEBUG_MISC) 1248 printf("%s: invalid value\n", __func__); 1249 V_pfsyncstats.pfsyncs_badval++; 1250 continue; 1251 } 1252 1253 if (pfsync_state_import(sp, flags, msg_version) != 0) 1254 V_pfsyncstats.pfsyncs_badact++; 1255 } 1256 1257 return (total_len); 1258 } 1259 1260 static int 1261 pfsync_in_iack(struct mbuf *m, int offset, int count, int flags, int action) 1262 { 1263 struct pfsync_ins_ack *ia, *iaa; 1264 struct pf_kstate *st; 1265 1266 struct mbuf *mp; 1267 int len = count * sizeof(*ia); 1268 int offp, i; 1269 1270 mp = m_pulldown(m, offset, len, &offp); 1271 if (mp == NULL) { 1272 V_pfsyncstats.pfsyncs_badlen++; 1273 return (-1); 1274 } 1275 iaa = (struct pfsync_ins_ack *)(mp->m_data + offp); 1276 1277 for (i = 0; i < count; i++) { 1278 ia = &iaa[i]; 1279 1280 st = pf_find_state_byid(ia->id, ia->creatorid); 1281 if (st == NULL) 1282 continue; 1283 1284 if (st->state_flags & PFSTATE_ACK) { 1285 pfsync_undefer_state(st, 0); 1286 } 1287 PF_STATE_UNLOCK(st); 1288 } 1289 /* 1290 * XXX this is not yet implemented, but we know the size of the 1291 * message so we can skip it. 1292 */ 1293 1294 return (count * sizeof(struct pfsync_ins_ack)); 1295 } 1296 1297 static int 1298 pfsync_upd_tcp(struct pf_kstate *st, struct pf_state_peer_export *src, 1299 struct pf_state_peer_export *dst) 1300 { 1301 int sync = 0; 1302 1303 PF_STATE_LOCK_ASSERT(st); 1304 1305 /* 1306 * The state should never go backwards except 1307 * for syn-proxy states. Neither should the 1308 * sequence window slide backwards. 1309 */ 1310 if ((st->src.state > src->state && 1311 (st->src.state < PF_TCPS_PROXY_SRC || 1312 src->state >= PF_TCPS_PROXY_SRC)) || 1313 1314 (st->src.state == src->state && 1315 SEQ_GT(st->src.seqlo, ntohl(src->seqlo)))) 1316 sync++; 1317 else 1318 pf_state_peer_ntoh(src, &st->src); 1319 1320 if ((st->dst.state > dst->state) || 1321 1322 (st->dst.state >= TCPS_SYN_SENT && 1323 SEQ_GT(st->dst.seqlo, ntohl(dst->seqlo)))) 1324 sync++; 1325 else 1326 pf_state_peer_ntoh(dst, &st->dst); 1327 1328 return (sync); 1329 } 1330 1331 static int 1332 pfsync_in_upd(struct mbuf *m, int offset, int count, int flags, int action) 1333 { 1334 struct pfsync_softc *sc = V_pfsyncif; 1335 union pfsync_state_union *sa, *sp; 1336 struct pf_kstate *st; 1337 struct mbuf *mp; 1338 int sync, offp, i, total_len, msg_len, msg_version; 1339 u_int8_t timeout; 1340 1341 switch (action) { 1342 case PFSYNC_ACT_UPD_1301: 1343 msg_len = sizeof(struct pfsync_state_1301); 1344 msg_version = PFSYNC_MSG_VERSION_1301; 1345 break; 1346 case PFSYNC_ACT_UPD_1400: 1347 msg_len = sizeof(struct pfsync_state_1400); 1348 msg_version = PFSYNC_MSG_VERSION_1400; 1349 break; 1350 case PFSYNC_ACT_UPD_1500: 1351 msg_len = sizeof(struct pfsync_state_1500); 1352 msg_version = PFSYNC_MSG_VERSION_1500; 1353 break; 1354 default: 1355 V_pfsyncstats.pfsyncs_badact++; 1356 return (-1); 1357 } 1358 1359 total_len = msg_len * count; 1360 1361 mp = m_pulldown(m, offset, total_len, &offp); 1362 if (mp == NULL) { 1363 V_pfsyncstats.pfsyncs_badlen++; 1364 return (-1); 1365 } 1366 sa = (union pfsync_state_union *)(mp->m_data + offp); 1367 1368 for (i = 0; i < count; i++) { 1369 sp = (union pfsync_state_union *)((char *)sa + msg_len * i); 1370 1371 switch (msg_version) { 1372 case PFSYNC_MSG_VERSION_1301: 1373 case PFSYNC_MSG_VERSION_1400: 1374 timeout = sp->pfs_1301.timeout; 1375 break; 1376 case PFSYNC_MSG_VERSION_1500: 1377 timeout = sp->pfs_1500.timeout; 1378 break; 1379 } 1380 1381 /* check for invalid values */ 1382 if (timeout >= PFTM_MAX || 1383 sp->pfs_1301.src.state > PF_TCPS_PROXY_DST || 1384 sp->pfs_1301.dst.state > PF_TCPS_PROXY_DST) { 1385 if (V_pf_status.debug >= PF_DEBUG_MISC) { 1386 printf("pfsync_input: PFSYNC_ACT_UPD: " 1387 "invalid value\n"); 1388 } 1389 V_pfsyncstats.pfsyncs_badval++; 1390 continue; 1391 } 1392 1393 st = pf_find_state_byid(sp->pfs_1301.id, sp->pfs_1301.creatorid); 1394 if (st == NULL) { 1395 /* insert the update */ 1396 if (pfsync_state_import(sp, flags, msg_version)) 1397 V_pfsyncstats.pfsyncs_badstate++; 1398 continue; 1399 } 1400 1401 if (st->state_flags & PFSTATE_ACK) { 1402 pfsync_undefer_state(st, 1); 1403 } 1404 1405 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) 1406 sync = pfsync_upd_tcp(st, &sp->pfs_1301.src, &sp->pfs_1301.dst); 1407 else { 1408 sync = 0; 1409 1410 /* 1411 * Non-TCP protocol state machine always go 1412 * forwards 1413 */ 1414 if (st->src.state > sp->pfs_1301.src.state) 1415 sync++; 1416 else 1417 pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src); 1418 if (st->dst.state > sp->pfs_1301.dst.state) 1419 sync++; 1420 else 1421 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst); 1422 } 1423 if (sync < 2) { 1424 pfsync_alloc_scrub_memory(&sp->pfs_1301.dst, &st->dst); 1425 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst); 1426 st->expire = pf_get_uptime(); 1427 st->timeout = timeout; 1428 } 1429 st->pfsync_time = time_uptime; 1430 1431 if (sync) { 1432 V_pfsyncstats.pfsyncs_stale++; 1433 1434 pfsync_update_state(st); 1435 PF_STATE_UNLOCK(st); 1436 pfsync_push_all(sc); 1437 continue; 1438 } 1439 PF_STATE_UNLOCK(st); 1440 } 1441 1442 return (total_len); 1443 } 1444 1445 static int 1446 pfsync_in_upd_c(struct mbuf *m, int offset, int count, int flags, int action) 1447 { 1448 struct pfsync_softc *sc = V_pfsyncif; 1449 struct pfsync_upd_c *ua, *up; 1450 struct pf_kstate *st; 1451 int len = count * sizeof(*up); 1452 int sync; 1453 struct mbuf *mp; 1454 int offp, i; 1455 1456 mp = m_pulldown(m, offset, len, &offp); 1457 if (mp == NULL) { 1458 V_pfsyncstats.pfsyncs_badlen++; 1459 return (-1); 1460 } 1461 ua = (struct pfsync_upd_c *)(mp->m_data + offp); 1462 1463 for (i = 0; i < count; i++) { 1464 up = &ua[i]; 1465 1466 /* check for invalid values */ 1467 if (up->timeout >= PFTM_MAX || 1468 up->src.state > PF_TCPS_PROXY_DST || 1469 up->dst.state > PF_TCPS_PROXY_DST) { 1470 if (V_pf_status.debug >= PF_DEBUG_MISC) { 1471 printf("pfsync_input: " 1472 "PFSYNC_ACT_UPD_C: " 1473 "invalid value\n"); 1474 } 1475 V_pfsyncstats.pfsyncs_badval++; 1476 continue; 1477 } 1478 1479 st = pf_find_state_byid(up->id, up->creatorid); 1480 if (st == NULL) { 1481 /* We don't have this state. Ask for it. */ 1482 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]); 1483 pfsync_request_update(up->creatorid, up->id); 1484 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]); 1485 continue; 1486 } 1487 1488 if (st->state_flags & PFSTATE_ACK) { 1489 pfsync_undefer_state(st, 1); 1490 } 1491 1492 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) 1493 sync = pfsync_upd_tcp(st, &up->src, &up->dst); 1494 else { 1495 sync = 0; 1496 1497 /* 1498 * Non-TCP protocol state machine always go 1499 * forwards 1500 */ 1501 if (st->src.state > up->src.state) 1502 sync++; 1503 else 1504 pf_state_peer_ntoh(&up->src, &st->src); 1505 if (st->dst.state > up->dst.state) 1506 sync++; 1507 else 1508 pf_state_peer_ntoh(&up->dst, &st->dst); 1509 } 1510 if (sync < 2) { 1511 pfsync_alloc_scrub_memory(&up->dst, &st->dst); 1512 pf_state_peer_ntoh(&up->dst, &st->dst); 1513 st->expire = pf_get_uptime(); 1514 st->timeout = up->timeout; 1515 } 1516 st->pfsync_time = time_uptime; 1517 1518 if (sync) { 1519 V_pfsyncstats.pfsyncs_stale++; 1520 1521 pfsync_update_state(st); 1522 PF_STATE_UNLOCK(st); 1523 pfsync_push_all(sc); 1524 continue; 1525 } 1526 PF_STATE_UNLOCK(st); 1527 } 1528 1529 return (len); 1530 } 1531 1532 static int 1533 pfsync_in_ureq(struct mbuf *m, int offset, int count, int flags, int action) 1534 { 1535 struct pfsync_upd_req *ur, *ura; 1536 struct mbuf *mp; 1537 int len = count * sizeof(*ur); 1538 int i, offp; 1539 1540 struct pf_kstate *st; 1541 1542 mp = m_pulldown(m, offset, len, &offp); 1543 if (mp == NULL) { 1544 V_pfsyncstats.pfsyncs_badlen++; 1545 return (-1); 1546 } 1547 ura = (struct pfsync_upd_req *)(mp->m_data + offp); 1548 1549 for (i = 0; i < count; i++) { 1550 ur = &ura[i]; 1551 1552 if (ur->id == 0 && ur->creatorid == 0) 1553 pfsync_bulk_start(); 1554 else { 1555 st = pf_find_state_byid(ur->id, ur->creatorid); 1556 if (st == NULL) { 1557 V_pfsyncstats.pfsyncs_badstate++; 1558 continue; 1559 } 1560 if (st->state_flags & PFSTATE_NOSYNC) { 1561 PF_STATE_UNLOCK(st); 1562 continue; 1563 } 1564 1565 pfsync_update_state_req(st); 1566 PF_STATE_UNLOCK(st); 1567 } 1568 } 1569 1570 return (len); 1571 } 1572 1573 static int 1574 pfsync_in_del_c(struct mbuf *m, int offset, int count, int flags, int action) 1575 { 1576 struct mbuf *mp; 1577 struct pfsync_del_c *sa, *sp; 1578 struct pf_kstate *st; 1579 int len = count * sizeof(*sp); 1580 int offp, i; 1581 1582 mp = m_pulldown(m, offset, len, &offp); 1583 if (mp == NULL) { 1584 V_pfsyncstats.pfsyncs_badlen++; 1585 return (-1); 1586 } 1587 sa = (struct pfsync_del_c *)(mp->m_data + offp); 1588 1589 for (i = 0; i < count; i++) { 1590 sp = &sa[i]; 1591 1592 st = pf_find_state_byid(sp->id, sp->creatorid); 1593 if (st == NULL) { 1594 V_pfsyncstats.pfsyncs_badstate++; 1595 continue; 1596 } 1597 1598 st->state_flags |= PFSTATE_NOSYNC; 1599 pf_remove_state(st); 1600 } 1601 1602 return (len); 1603 } 1604 1605 static int 1606 pfsync_in_bus(struct mbuf *m, int offset, int count, int flags, int action) 1607 { 1608 struct pfsync_softc *sc = V_pfsyncif; 1609 struct pfsync_bus *bus; 1610 struct mbuf *mp; 1611 int len = count * sizeof(*bus); 1612 int offp; 1613 1614 PFSYNC_BLOCK(sc); 1615 1616 /* If we're not waiting for a bulk update, who cares. */ 1617 if (sc->sc_ureq_sent == 0) { 1618 PFSYNC_BUNLOCK(sc); 1619 return (len); 1620 } 1621 1622 mp = m_pulldown(m, offset, len, &offp); 1623 if (mp == NULL) { 1624 PFSYNC_BUNLOCK(sc); 1625 V_pfsyncstats.pfsyncs_badlen++; 1626 return (-1); 1627 } 1628 bus = (struct pfsync_bus *)(mp->m_data + offp); 1629 1630 switch (bus->status) { 1631 case PFSYNC_BUS_START: 1632 callout_reset(&sc->sc_bulkfail_tmo, 4 * hz + 1633 V_pf_limits[PF_LIMIT_STATES].limit / 1634 ((sc->sc_ifp->if_mtu - PFSYNC_MINPKT) / 1635 sizeof(union pfsync_state_union)), 1636 pfsync_bulk_fail, sc); 1637 if (V_pf_status.debug >= PF_DEBUG_MISC) 1638 printf("pfsync: received bulk update start\n"); 1639 break; 1640 1641 case PFSYNC_BUS_END: 1642 if (time_uptime - ntohl(bus->endtime) >= 1643 sc->sc_ureq_sent) { 1644 /* that's it, we're happy */ 1645 sc->sc_ureq_sent = 0; 1646 sc->sc_bulk_tries = 0; 1647 callout_stop(&sc->sc_bulkfail_tmo); 1648 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p) 1649 (*carp_demote_adj_p)(-V_pfsync_carp_adj, 1650 "pfsync bulk done"); 1651 sc->sc_flags |= PFSYNCF_OK; 1652 if (V_pf_status.debug >= PF_DEBUG_MISC) 1653 printf("pfsync: received valid " 1654 "bulk update end\n"); 1655 } else { 1656 if (V_pf_status.debug >= PF_DEBUG_MISC) 1657 printf("pfsync: received invalid " 1658 "bulk update end: bad timestamp\n"); 1659 } 1660 break; 1661 } 1662 PFSYNC_BUNLOCK(sc); 1663 1664 return (len); 1665 } 1666 1667 static int 1668 pfsync_in_tdb(struct mbuf *m, int offset, int count, int flags, int action) 1669 { 1670 int len = count * sizeof(struct pfsync_tdb); 1671 1672 #if defined(IPSEC) 1673 struct pfsync_tdb *tp; 1674 struct mbuf *mp; 1675 int offp; 1676 int i; 1677 int s; 1678 1679 mp = m_pulldown(m, offset, len, &offp); 1680 if (mp == NULL) { 1681 V_pfsyncstats.pfsyncs_badlen++; 1682 return (-1); 1683 } 1684 tp = (struct pfsync_tdb *)(mp->m_data + offp); 1685 1686 for (i = 0; i < count; i++) 1687 pfsync_update_net_tdb(&tp[i]); 1688 #endif 1689 1690 return (len); 1691 } 1692 1693 #if defined(IPSEC) 1694 /* Update an in-kernel tdb. Silently fail if no tdb is found. */ 1695 static void 1696 pfsync_update_net_tdb(struct pfsync_tdb *pt) 1697 { 1698 struct tdb *tdb; 1699 int s; 1700 1701 /* check for invalid values */ 1702 if (ntohl(pt->spi) <= SPI_RESERVED_MAX || 1703 (pt->dst.sa.sa_family != AF_INET && 1704 pt->dst.sa.sa_family != AF_INET6)) 1705 goto bad; 1706 1707 tdb = gettdb(pt->spi, &pt->dst, pt->sproto); 1708 if (tdb) { 1709 pt->rpl = ntohl(pt->rpl); 1710 pt->cur_bytes = (unsigned long long)be64toh(pt->cur_bytes); 1711 1712 /* Neither replay nor byte counter should ever decrease. */ 1713 if (pt->rpl < tdb->tdb_rpl || 1714 pt->cur_bytes < tdb->tdb_cur_bytes) { 1715 goto bad; 1716 } 1717 1718 tdb->tdb_rpl = pt->rpl; 1719 tdb->tdb_cur_bytes = pt->cur_bytes; 1720 } 1721 return; 1722 1723 bad: 1724 if (V_pf_status.debug >= PF_DEBUG_MISC) 1725 printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: " 1726 "invalid value\n"); 1727 V_pfsyncstats.pfsyncs_badstate++; 1728 return; 1729 } 1730 #endif 1731 1732 static int 1733 pfsync_in_eof(struct mbuf *m, int offset, int count, int flags, int action) 1734 { 1735 /* check if we are at the right place in the packet */ 1736 if (offset != m->m_pkthdr.len) 1737 V_pfsyncstats.pfsyncs_badlen++; 1738 1739 /* we're done. free and let the caller return */ 1740 m_freem(m); 1741 return (-1); 1742 } 1743 1744 static int 1745 pfsync_in_error(struct mbuf *m, int offset, int count, int flags, int action) 1746 { 1747 V_pfsyncstats.pfsyncs_badact++; 1748 1749 m_freem(m); 1750 return (-1); 1751 } 1752 1753 static int 1754 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 1755 struct route *rt) 1756 { 1757 m_freem(m); 1758 return (0); 1759 } 1760 1761 /* ARGSUSED */ 1762 static int 1763 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 1764 { 1765 struct pfsync_softc *sc = ifp->if_softc; 1766 struct ifreq *ifr = (struct ifreq *)data; 1767 struct pfsyncreq pfsyncr; 1768 size_t nvbuflen; 1769 int error; 1770 int c; 1771 1772 switch (cmd) { 1773 case SIOCSIFFLAGS: 1774 PFSYNC_LOCK(sc); 1775 if (ifp->if_flags & IFF_UP) { 1776 ifp->if_drv_flags |= IFF_DRV_RUNNING; 1777 PFSYNC_UNLOCK(sc); 1778 pfsync_pointers_init(); 1779 } else { 1780 ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1781 PFSYNC_UNLOCK(sc); 1782 pfsync_pointers_uninit(); 1783 } 1784 break; 1785 case SIOCSIFMTU: 1786 if (!sc->sc_sync_if || 1787 ifr->ifr_mtu <= PFSYNC_MINPKT || 1788 ifr->ifr_mtu > sc->sc_sync_if->if_mtu) 1789 return (EINVAL); 1790 if (ifr->ifr_mtu < ifp->if_mtu) { 1791 for (c = 0; c < pfsync_buckets; c++) { 1792 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]); 1793 if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT) 1794 pfsync_sendout(1, c); 1795 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]); 1796 } 1797 } 1798 ifp->if_mtu = ifr->ifr_mtu; 1799 break; 1800 case SIOCGETPFSYNC: 1801 bzero(&pfsyncr, sizeof(pfsyncr)); 1802 PFSYNC_LOCK(sc); 1803 if (sc->sc_sync_if) { 1804 strlcpy(pfsyncr.pfsyncr_syncdev, 1805 sc->sc_sync_if->if_xname, IFNAMSIZ); 1806 } 1807 pfsyncr.pfsyncr_syncpeer = ((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr; 1808 pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates; 1809 pfsyncr.pfsyncr_defer = sc->sc_flags; 1810 PFSYNC_UNLOCK(sc); 1811 return (copyout(&pfsyncr, ifr_data_get_ptr(ifr), 1812 sizeof(pfsyncr))); 1813 1814 case SIOCGETPFSYNCNV: 1815 { 1816 nvlist_t *nvl_syncpeer; 1817 nvlist_t *nvl = nvlist_create(0); 1818 1819 if (nvl == NULL) 1820 return (ENOMEM); 1821 1822 if (sc->sc_sync_if) 1823 nvlist_add_string(nvl, "syncdev", sc->sc_sync_if->if_xname); 1824 nvlist_add_number(nvl, "maxupdates", sc->sc_maxupdates); 1825 nvlist_add_number(nvl, "flags", sc->sc_flags); 1826 nvlist_add_number(nvl, "version", sc->sc_version); 1827 if ((nvl_syncpeer = pfsync_sockaddr_to_syncpeer_nvlist(&sc->sc_sync_peer)) != NULL) 1828 nvlist_add_nvlist(nvl, "syncpeer", nvl_syncpeer); 1829 1830 void *packed = NULL; 1831 packed = nvlist_pack(nvl, &nvbuflen); 1832 if (packed == NULL) { 1833 free(packed, M_NVLIST); 1834 nvlist_destroy(nvl); 1835 return (ENOMEM); 1836 } 1837 1838 if (nvbuflen > ifr->ifr_cap_nv.buf_length) { 1839 ifr->ifr_cap_nv.length = nvbuflen; 1840 ifr->ifr_cap_nv.buffer = NULL; 1841 free(packed, M_NVLIST); 1842 nvlist_destroy(nvl); 1843 return (EFBIG); 1844 } 1845 1846 ifr->ifr_cap_nv.length = nvbuflen; 1847 error = copyout(packed, ifr->ifr_cap_nv.buffer, nvbuflen); 1848 1849 nvlist_destroy(nvl); 1850 nvlist_destroy(nvl_syncpeer); 1851 free(packed, M_NVLIST); 1852 break; 1853 } 1854 1855 case SIOCSETPFSYNC: 1856 { 1857 struct pfsync_kstatus status; 1858 1859 if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0) 1860 return (error); 1861 if ((error = copyin(ifr_data_get_ptr(ifr), &pfsyncr, 1862 sizeof(pfsyncr)))) 1863 return (error); 1864 1865 memset((char *)&status, 0, sizeof(struct pfsync_kstatus)); 1866 pfsync_pfsyncreq_to_kstatus(&pfsyncr, &status); 1867 1868 error = pfsync_kstatus_to_softc(&status, sc); 1869 return (error); 1870 } 1871 case SIOCSETPFSYNCNV: 1872 { 1873 struct pfsync_kstatus status; 1874 void *data; 1875 nvlist_t *nvl; 1876 1877 if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0) 1878 return (error); 1879 if (ifr->ifr_cap_nv.length > IFR_CAP_NV_MAXBUFSIZE) 1880 return (EINVAL); 1881 1882 data = malloc(ifr->ifr_cap_nv.length, M_PF, M_WAITOK); 1883 1884 if ((error = copyin(ifr->ifr_cap_nv.buffer, data, 1885 ifr->ifr_cap_nv.length)) != 0) { 1886 free(data, M_PF); 1887 return (error); 1888 } 1889 1890 if ((nvl = nvlist_unpack(data, ifr->ifr_cap_nv.length, 0)) == NULL) { 1891 free(data, M_PF); 1892 return (EINVAL); 1893 } 1894 1895 memset((char *)&status, 0, sizeof(struct pfsync_kstatus)); 1896 pfsync_nvstatus_to_kstatus(nvl, &status); 1897 1898 nvlist_destroy(nvl); 1899 free(data, M_PF); 1900 1901 error = pfsync_kstatus_to_softc(&status, sc); 1902 return (error); 1903 } 1904 default: 1905 return (ENOTTY); 1906 } 1907 1908 return (0); 1909 } 1910 1911 static void 1912 pfsync_out_state_1301(struct pf_kstate *st, void *buf) 1913 { 1914 struct pfsync_state_1301 *sp; 1915 1916 sp = buf; 1917 pfsync_state_export_1301(sp, st); 1918 } 1919 1920 static void 1921 pfsync_out_state_1400(struct pf_kstate *st, void *buf) 1922 { 1923 struct pfsync_state_1400 *sp; 1924 1925 sp = buf; 1926 pfsync_state_export_1400(sp, st); 1927 } 1928 1929 static void 1930 pfsync_out_state_1500(struct pf_kstate *st, void *buf) 1931 { 1932 struct pfsync_state_1500 *sp; 1933 1934 sp = buf; 1935 pfsync_state_export_1500(sp, st); 1936 } 1937 1938 static void 1939 pfsync_out_iack(struct pf_kstate *st, void *buf) 1940 { 1941 struct pfsync_ins_ack *iack = buf; 1942 1943 iack->id = st->id; 1944 iack->creatorid = st->creatorid; 1945 } 1946 1947 static void 1948 pfsync_out_upd_c(struct pf_kstate *st, void *buf) 1949 { 1950 struct pfsync_upd_c *up = buf; 1951 1952 bzero(up, sizeof(*up)); 1953 up->id = st->id; 1954 pf_state_peer_hton(&st->src, &up->src); 1955 pf_state_peer_hton(&st->dst, &up->dst); 1956 up->creatorid = st->creatorid; 1957 up->timeout = st->timeout; 1958 } 1959 1960 static void 1961 pfsync_out_del_c(struct pf_kstate *st, void *buf) 1962 { 1963 struct pfsync_del_c *dp = buf; 1964 1965 dp->id = st->id; 1966 dp->creatorid = st->creatorid; 1967 st->state_flags |= PFSTATE_NOSYNC; 1968 } 1969 1970 static void 1971 pfsync_drop_all(struct pfsync_softc *sc) 1972 { 1973 struct pfsync_bucket *b; 1974 int c; 1975 1976 for (c = 0; c < pfsync_buckets; c++) { 1977 b = &sc->sc_buckets[c]; 1978 1979 PFSYNC_BUCKET_LOCK(b); 1980 pfsync_drop(sc, c); 1981 PFSYNC_BUCKET_UNLOCK(b); 1982 } 1983 } 1984 1985 static void 1986 pfsync_drop(struct pfsync_softc *sc, int c) 1987 { 1988 struct pf_kstate *st, *next; 1989 struct pfsync_upd_req_item *ur; 1990 struct pfsync_bucket *b; 1991 enum pfsync_q_id q; 1992 1993 b = &sc->sc_buckets[c]; 1994 PFSYNC_BUCKET_LOCK_ASSERT(b); 1995 1996 for (q = 0; q < PFSYNC_Q_COUNT; q++) { 1997 if (TAILQ_EMPTY(&b->b_qs[q])) 1998 continue; 1999 2000 TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, next) { 2001 KASSERT(st->sync_state == pfsync_qid_sstate[q], 2002 ("%s: st->sync_state %d == q %d", 2003 __func__, st->sync_state, q)); 2004 st->sync_state = PFSYNC_S_NONE; 2005 pf_release_state(st); 2006 } 2007 TAILQ_INIT(&b->b_qs[q]); 2008 } 2009 2010 while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) { 2011 TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry); 2012 free(ur, M_PFSYNC); 2013 } 2014 2015 b->b_len = PFSYNC_MINPKT; 2016 free(b->b_plus, M_PFSYNC); 2017 b->b_plus = NULL; 2018 b->b_pluslen = 0; 2019 } 2020 2021 static void 2022 pfsync_sendout(int schedswi, int c) 2023 { 2024 struct pfsync_softc *sc = V_pfsyncif; 2025 struct ifnet *ifp = sc->sc_ifp; 2026 struct mbuf *m; 2027 struct pfsync_header *ph; 2028 struct pfsync_subheader *subh; 2029 struct pf_kstate *st, *st_next; 2030 struct pfsync_upd_req_item *ur; 2031 struct pfsync_bucket *b = &sc->sc_buckets[c]; 2032 size_t len; 2033 int aflen, offset, count = 0; 2034 enum pfsync_q_id q; 2035 2036 KASSERT(sc != NULL, ("%s: null sc", __func__)); 2037 KASSERT(b->b_len > PFSYNC_MINPKT, 2038 ("%s: sc_len %zu", __func__, b->b_len)); 2039 PFSYNC_BUCKET_LOCK_ASSERT(b); 2040 2041 if (!bpf_peers_present(ifp->if_bpf) && sc->sc_sync_if == NULL) { 2042 pfsync_drop(sc, c); 2043 return; 2044 } 2045 2046 m = m_get3(max_linkhdr + b->b_len, M_NOWAIT, MT_DATA, M_PKTHDR); 2047 if (m == NULL) { 2048 if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1); 2049 V_pfsyncstats.pfsyncs_onomem++; 2050 return; 2051 } 2052 m->m_data += max_linkhdr; 2053 bzero(m->m_data, b->b_len); 2054 2055 len = b->b_len; 2056 2057 /* build the ip header */ 2058 switch (sc->sc_sync_peer.ss_family) { 2059 #ifdef INET 2060 case AF_INET: 2061 { 2062 struct ip *ip; 2063 2064 ip = mtod(m, struct ip *); 2065 bcopy(&sc->sc_template.ipv4, ip, sizeof(*ip)); 2066 aflen = offset = sizeof(*ip); 2067 2068 len -= sizeof(union inet_template) - sizeof(struct ip); 2069 ip->ip_len = htons(len); 2070 ip_fillid(ip, V_ip_random_id); 2071 break; 2072 } 2073 #endif 2074 #ifdef INET6 2075 case AF_INET6: 2076 { 2077 struct ip6_hdr *ip6; 2078 2079 ip6 = mtod(m, struct ip6_hdr *); 2080 bcopy(&sc->sc_template.ipv6, ip6, sizeof(*ip6)); 2081 aflen = offset = sizeof(*ip6); 2082 2083 len -= sizeof(union inet_template) - sizeof(struct ip6_hdr); 2084 ip6->ip6_plen = htons(len); 2085 break; 2086 } 2087 #endif 2088 default: 2089 m_freem(m); 2090 pfsync_drop(sc, c); 2091 return; 2092 } 2093 m->m_len = m->m_pkthdr.len = len; 2094 2095 /* build the pfsync header */ 2096 ph = (struct pfsync_header *)(m->m_data + offset); 2097 offset += sizeof(*ph); 2098 2099 ph->version = PFSYNC_VERSION; 2100 ph->len = htons(len - aflen); 2101 bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH); 2102 2103 /* walk the queues */ 2104 for (q = 0; q < PFSYNC_Q_COUNT; q++) { 2105 if (TAILQ_EMPTY(&b->b_qs[q])) 2106 continue; 2107 2108 subh = (struct pfsync_subheader *)(m->m_data + offset); 2109 offset += sizeof(*subh); 2110 2111 count = 0; 2112 TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, st_next) { 2113 KASSERT(st->sync_state == pfsync_qid_sstate[q], 2114 ("%s: st->sync_state == q", 2115 __func__)); 2116 /* 2117 * XXXGL: some of write methods do unlocked reads 2118 * of state data :( 2119 */ 2120 pfsync_qs[q].write(st, m->m_data + offset); 2121 offset += pfsync_qs[q].len; 2122 st->sync_state = PFSYNC_S_NONE; 2123 pf_release_state(st); 2124 count++; 2125 } 2126 TAILQ_INIT(&b->b_qs[q]); 2127 2128 subh->action = pfsync_qs[q].action; 2129 subh->count = htons(count); 2130 V_pfsyncstats.pfsyncs_oacts[pfsync_qs[q].action] += count; 2131 } 2132 2133 if (!TAILQ_EMPTY(&b->b_upd_req_list)) { 2134 subh = (struct pfsync_subheader *)(m->m_data + offset); 2135 offset += sizeof(*subh); 2136 2137 count = 0; 2138 while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) { 2139 TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry); 2140 2141 bcopy(&ur->ur_msg, m->m_data + offset, 2142 sizeof(ur->ur_msg)); 2143 offset += sizeof(ur->ur_msg); 2144 free(ur, M_PFSYNC); 2145 count++; 2146 } 2147 2148 subh->action = PFSYNC_ACT_UPD_REQ; 2149 subh->count = htons(count); 2150 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_UPD_REQ] += count; 2151 } 2152 2153 /* has someone built a custom region for us to add? */ 2154 if (b->b_plus != NULL) { 2155 bcopy(b->b_plus, m->m_data + offset, b->b_pluslen); 2156 offset += b->b_pluslen; 2157 2158 free(b->b_plus, M_PFSYNC); 2159 b->b_plus = NULL; 2160 b->b_pluslen = 0; 2161 } 2162 2163 subh = (struct pfsync_subheader *)(m->m_data + offset); 2164 offset += sizeof(*subh); 2165 2166 subh->action = PFSYNC_ACT_EOF; 2167 subh->count = htons(1); 2168 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_EOF]++; 2169 2170 /* we're done, let's put it on the wire */ 2171 if (bpf_peers_present(ifp->if_bpf)) { 2172 m->m_data += aflen; 2173 m->m_len = m->m_pkthdr.len = len - aflen; 2174 bpf_mtap(ifp->if_bpf, m); 2175 m->m_data -= aflen; 2176 m->m_len = m->m_pkthdr.len = len; 2177 } 2178 2179 if (sc->sc_sync_if == NULL) { 2180 b->b_len = PFSYNC_MINPKT; 2181 m_freem(m); 2182 return; 2183 } 2184 2185 if_inc_counter(sc->sc_ifp, IFCOUNTER_OPACKETS, 1); 2186 if_inc_counter(sc->sc_ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len); 2187 b->b_len = PFSYNC_MINPKT; 2188 2189 if (!_IF_QFULL(&b->b_snd)) 2190 _IF_ENQUEUE(&b->b_snd, m); 2191 else { 2192 m_freem(m); 2193 if_inc_counter(sc->sc_ifp, IFCOUNTER_OQDROPS, 1); 2194 } 2195 if (schedswi) 2196 swi_sched(V_pfsync_swi_cookie, 0); 2197 } 2198 2199 static void 2200 pfsync_insert_state(struct pf_kstate *st) 2201 { 2202 struct pfsync_softc *sc = V_pfsyncif; 2203 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2204 2205 if (st->state_flags & PFSTATE_NOSYNC) 2206 return; 2207 2208 if ((st->rule->rule_flag & PFRULE_NOSYNC) || 2209 st->key[PF_SK_WIRE]->proto == IPPROTO_PFSYNC) { 2210 st->state_flags |= PFSTATE_NOSYNC; 2211 return; 2212 } 2213 2214 KASSERT(st->sync_state == PFSYNC_S_NONE, 2215 ("%s: st->sync_state %u", __func__, st->sync_state)); 2216 2217 PFSYNC_BUCKET_LOCK(b); 2218 if (b->b_len == PFSYNC_MINPKT) 2219 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b); 2220 2221 pfsync_q_ins(st, PFSYNC_S_INS, true); 2222 PFSYNC_BUCKET_UNLOCK(b); 2223 2224 st->sync_updates = 0; 2225 } 2226 2227 static int 2228 pfsync_defer(struct pf_kstate *st, struct mbuf *m) 2229 { 2230 struct pfsync_softc *sc = V_pfsyncif; 2231 struct pfsync_deferral *pd; 2232 struct pfsync_bucket *b; 2233 2234 if (m->m_flags & (M_BCAST|M_MCAST)) 2235 return (0); 2236 2237 if (sc == NULL) 2238 return (0); 2239 2240 b = pfsync_get_bucket(sc, st); 2241 2242 PFSYNC_LOCK(sc); 2243 2244 if (!(sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) || 2245 !(sc->sc_flags & PFSYNCF_DEFER)) { 2246 PFSYNC_UNLOCK(sc); 2247 return (0); 2248 } 2249 2250 PFSYNC_BUCKET_LOCK(b); 2251 PFSYNC_UNLOCK(sc); 2252 2253 if (b->b_deferred >= 128) 2254 pfsync_undefer(TAILQ_FIRST(&b->b_deferrals), 0); 2255 2256 pd = malloc(sizeof(*pd), M_PFSYNC, M_NOWAIT); 2257 if (pd == NULL) { 2258 PFSYNC_BUCKET_UNLOCK(b); 2259 return (0); 2260 } 2261 b->b_deferred++; 2262 2263 m->m_flags |= M_SKIP_FIREWALL; 2264 st->state_flags |= PFSTATE_ACK; 2265 2266 pd->pd_sc = sc; 2267 pd->pd_st = st; 2268 pf_ref_state(st); 2269 pd->pd_m = m; 2270 2271 TAILQ_INSERT_TAIL(&b->b_deferrals, pd, pd_entry); 2272 callout_init_mtx(&pd->pd_tmo, &b->b_mtx, CALLOUT_RETURNUNLOCKED); 2273 callout_reset(&pd->pd_tmo, (V_pfsync_defer_timeout * hz) / 1000, 2274 pfsync_defer_tmo, pd); 2275 2276 pfsync_push(b); 2277 PFSYNC_BUCKET_UNLOCK(b); 2278 2279 return (1); 2280 } 2281 2282 static void 2283 pfsync_undefer(struct pfsync_deferral *pd, int drop) 2284 { 2285 struct pfsync_softc *sc = pd->pd_sc; 2286 struct mbuf *m = pd->pd_m; 2287 struct pf_kstate *st = pd->pd_st; 2288 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2289 2290 PFSYNC_BUCKET_LOCK_ASSERT(b); 2291 2292 TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry); 2293 b->b_deferred--; 2294 pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */ 2295 free(pd, M_PFSYNC); 2296 pf_release_state(st); 2297 2298 if (drop) 2299 m_freem(m); 2300 else { 2301 _IF_ENQUEUE(&b->b_snd, m); 2302 pfsync_push(b); 2303 } 2304 } 2305 2306 static void 2307 pfsync_defer_tmo(void *arg) 2308 { 2309 struct epoch_tracker et; 2310 struct pfsync_deferral *pd = arg; 2311 struct pfsync_softc *sc = pd->pd_sc; 2312 struct mbuf *m = pd->pd_m; 2313 struct pf_kstate *st = pd->pd_st; 2314 struct pfsync_bucket *b; 2315 2316 CURVNET_SET(sc->sc_ifp->if_vnet); 2317 2318 b = pfsync_get_bucket(sc, st); 2319 2320 PFSYNC_BUCKET_LOCK_ASSERT(b); 2321 2322 TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry); 2323 b->b_deferred--; 2324 pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */ 2325 PFSYNC_BUCKET_UNLOCK(b); 2326 free(pd, M_PFSYNC); 2327 2328 if (sc->sc_sync_if == NULL) { 2329 pf_release_state(st); 2330 m_freem(m); 2331 CURVNET_RESTORE(); 2332 return; 2333 } 2334 2335 NET_EPOCH_ENTER(et); 2336 2337 pfsync_tx(sc, m); 2338 2339 pf_release_state(st); 2340 2341 CURVNET_RESTORE(); 2342 NET_EPOCH_EXIT(et); 2343 } 2344 2345 static void 2346 pfsync_undefer_state_locked(struct pf_kstate *st, int drop) 2347 { 2348 struct pfsync_softc *sc = V_pfsyncif; 2349 struct pfsync_deferral *pd; 2350 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2351 2352 PFSYNC_BUCKET_LOCK_ASSERT(b); 2353 2354 TAILQ_FOREACH(pd, &b->b_deferrals, pd_entry) { 2355 if (pd->pd_st == st) { 2356 if (callout_stop(&pd->pd_tmo) > 0) 2357 pfsync_undefer(pd, drop); 2358 2359 return; 2360 } 2361 } 2362 2363 /* 2364 * If we don't find this state in b_deferrals that might be because we 2365 * overflowed the list (see pfsync_defer()'s >= 128 check') or because 2366 * the deferral timed out already (see pfsync_defer_tomo()). 2367 */ 2368 } 2369 2370 static void 2371 pfsync_undefer_state(struct pf_kstate *st, int drop) 2372 { 2373 struct pfsync_softc *sc = V_pfsyncif; 2374 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2375 2376 PFSYNC_BUCKET_LOCK(b); 2377 pfsync_undefer_state_locked(st, drop); 2378 PFSYNC_BUCKET_UNLOCK(b); 2379 } 2380 2381 static struct pfsync_bucket* 2382 pfsync_get_bucket(struct pfsync_softc *sc, struct pf_kstate *st) 2383 { 2384 int c = PF_IDHASH(st) % pfsync_buckets; 2385 return &sc->sc_buckets[c]; 2386 } 2387 2388 static void 2389 pfsync_update_state(struct pf_kstate *st) 2390 { 2391 struct pfsync_softc *sc = V_pfsyncif; 2392 bool sync = false, ref = true; 2393 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2394 2395 PF_STATE_LOCK_ASSERT(st); 2396 PFSYNC_BUCKET_LOCK(b); 2397 2398 if (st->state_flags & PFSTATE_ACK) 2399 pfsync_undefer_state_locked(st, 0); 2400 if (st->state_flags & PFSTATE_NOSYNC) { 2401 if (st->sync_state != PFSYNC_S_NONE) 2402 pfsync_q_del(st, true, b); 2403 PFSYNC_BUCKET_UNLOCK(b); 2404 return; 2405 } 2406 2407 if (b->b_len == PFSYNC_MINPKT) 2408 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b); 2409 2410 switch (st->sync_state) { 2411 case PFSYNC_S_UPD_C: 2412 case PFSYNC_S_UPD: 2413 case PFSYNC_S_INS: 2414 /* we're already handling it */ 2415 2416 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) { 2417 st->sync_updates++; 2418 if (st->sync_updates >= sc->sc_maxupdates) 2419 sync = true; 2420 } 2421 break; 2422 2423 case PFSYNC_S_IACK: 2424 pfsync_q_del(st, false, b); 2425 ref = false; 2426 /* FALLTHROUGH */ 2427 2428 case PFSYNC_S_NONE: 2429 pfsync_q_ins(st, PFSYNC_S_UPD_C, ref); 2430 st->sync_updates = 0; 2431 break; 2432 2433 default: 2434 panic("%s: unexpected sync state %d", __func__, st->sync_state); 2435 } 2436 2437 if (sync || (time_uptime - st->pfsync_time) < 2) 2438 pfsync_push(b); 2439 2440 PFSYNC_BUCKET_UNLOCK(b); 2441 } 2442 2443 static void 2444 pfsync_request_update(u_int32_t creatorid, u_int64_t id) 2445 { 2446 struct pfsync_softc *sc = V_pfsyncif; 2447 struct pfsync_bucket *b = &sc->sc_buckets[0]; 2448 struct pfsync_upd_req_item *item; 2449 size_t nlen = sizeof(struct pfsync_upd_req); 2450 2451 PFSYNC_BUCKET_LOCK_ASSERT(b); 2452 2453 /* 2454 * This code does a bit to prevent multiple update requests for the 2455 * same state being generated. It searches current subheader queue, 2456 * but it doesn't lookup into queue of already packed datagrams. 2457 */ 2458 TAILQ_FOREACH(item, &b->b_upd_req_list, ur_entry) 2459 if (item->ur_msg.id == id && 2460 item->ur_msg.creatorid == creatorid) 2461 return; 2462 2463 item = malloc(sizeof(*item), M_PFSYNC, M_NOWAIT); 2464 if (item == NULL) 2465 return; /* XXX stats */ 2466 2467 item->ur_msg.id = id; 2468 item->ur_msg.creatorid = creatorid; 2469 2470 if (TAILQ_EMPTY(&b->b_upd_req_list)) 2471 nlen += sizeof(struct pfsync_subheader); 2472 2473 if (b->b_len + nlen > sc->sc_ifp->if_mtu) { 2474 pfsync_sendout(0, 0); 2475 2476 nlen = sizeof(struct pfsync_subheader) + 2477 sizeof(struct pfsync_upd_req); 2478 } 2479 2480 TAILQ_INSERT_TAIL(&b->b_upd_req_list, item, ur_entry); 2481 b->b_len += nlen; 2482 2483 pfsync_push(b); 2484 } 2485 2486 static bool 2487 pfsync_update_state_req(struct pf_kstate *st) 2488 { 2489 struct pfsync_softc *sc = V_pfsyncif; 2490 bool ref = true, full = false; 2491 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2492 2493 PF_STATE_LOCK_ASSERT(st); 2494 PFSYNC_BUCKET_LOCK(b); 2495 2496 if (st->state_flags & PFSTATE_NOSYNC) { 2497 if (st->sync_state != PFSYNC_S_NONE) 2498 pfsync_q_del(st, true, b); 2499 PFSYNC_BUCKET_UNLOCK(b); 2500 return (full); 2501 } 2502 2503 switch (st->sync_state) { 2504 case PFSYNC_S_UPD_C: 2505 case PFSYNC_S_IACK: 2506 pfsync_q_del(st, false, b); 2507 ref = false; 2508 /* FALLTHROUGH */ 2509 2510 case PFSYNC_S_NONE: 2511 pfsync_q_ins(st, PFSYNC_S_UPD, ref); 2512 pfsync_push(b); 2513 break; 2514 2515 case PFSYNC_S_INS: 2516 case PFSYNC_S_UPD: 2517 case PFSYNC_S_DEL_C: 2518 /* we're already handling it */ 2519 break; 2520 2521 default: 2522 panic("%s: unexpected sync state %d", __func__, st->sync_state); 2523 } 2524 2525 if ((sc->sc_ifp->if_mtu - b->b_len) < sizeof(union pfsync_state_union)) 2526 full = true; 2527 2528 PFSYNC_BUCKET_UNLOCK(b); 2529 2530 return (full); 2531 } 2532 2533 static void 2534 pfsync_delete_state(struct pf_kstate *st) 2535 { 2536 struct pfsync_softc *sc = V_pfsyncif; 2537 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2538 bool ref = true; 2539 2540 PFSYNC_BUCKET_LOCK(b); 2541 if (st->state_flags & PFSTATE_ACK) 2542 pfsync_undefer_state_locked(st, 1); 2543 if (st->state_flags & PFSTATE_NOSYNC) { 2544 if (st->sync_state != PFSYNC_S_NONE) 2545 pfsync_q_del(st, true, b); 2546 PFSYNC_BUCKET_UNLOCK(b); 2547 return; 2548 } 2549 2550 if (b->b_len == PFSYNC_MINPKT) 2551 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b); 2552 2553 switch (st->sync_state) { 2554 case PFSYNC_S_INS: 2555 /* We never got to tell the world so just forget about it. */ 2556 pfsync_q_del(st, true, b); 2557 break; 2558 2559 case PFSYNC_S_UPD_C: 2560 case PFSYNC_S_UPD: 2561 case PFSYNC_S_IACK: 2562 pfsync_q_del(st, false, b); 2563 ref = false; 2564 /* FALLTHROUGH */ 2565 2566 case PFSYNC_S_NONE: 2567 pfsync_q_ins(st, PFSYNC_S_DEL_C, ref); 2568 break; 2569 2570 default: 2571 panic("%s: unexpected sync state %d", __func__, st->sync_state); 2572 } 2573 2574 PFSYNC_BUCKET_UNLOCK(b); 2575 } 2576 2577 static void 2578 pfsync_clear_states(u_int32_t creatorid, const char *ifname) 2579 { 2580 struct { 2581 struct pfsync_subheader subh; 2582 struct pfsync_clr clr; 2583 } __packed r; 2584 2585 bzero(&r, sizeof(r)); 2586 2587 r.subh.action = PFSYNC_ACT_CLR; 2588 r.subh.count = htons(1); 2589 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_CLR]++; 2590 2591 strlcpy(r.clr.ifname, ifname, sizeof(r.clr.ifname)); 2592 r.clr.creatorid = creatorid; 2593 2594 pfsync_send_plus(&r, sizeof(r)); 2595 } 2596 2597 static enum pfsync_q_id 2598 pfsync_sstate_to_qid(u_int8_t sync_state) 2599 { 2600 struct pfsync_softc *sc = V_pfsyncif; 2601 2602 switch (sync_state) { 2603 case PFSYNC_S_INS: 2604 switch (sc->sc_version) { 2605 case PFSYNC_MSG_VERSION_1301: 2606 return PFSYNC_Q_INS_1301; 2607 case PFSYNC_MSG_VERSION_1400: 2608 return PFSYNC_Q_INS_1400; 2609 case PFSYNC_MSG_VERSION_1500: 2610 return PFSYNC_Q_INS_1500; 2611 } 2612 break; 2613 case PFSYNC_S_IACK: 2614 return PFSYNC_Q_IACK; 2615 case PFSYNC_S_UPD: 2616 switch (sc->sc_version) { 2617 case PFSYNC_MSG_VERSION_1301: 2618 return PFSYNC_Q_UPD_1301; 2619 case PFSYNC_MSG_VERSION_1400: 2620 return PFSYNC_Q_UPD_1400; 2621 case PFSYNC_MSG_VERSION_1500: 2622 return PFSYNC_Q_UPD_1500; 2623 } 2624 break; 2625 case PFSYNC_S_UPD_C: 2626 return PFSYNC_Q_UPD_C; 2627 case PFSYNC_S_DEL_C: 2628 return PFSYNC_Q_DEL_C; 2629 default: 2630 panic("%s: Unsupported st->sync_state 0x%02x", 2631 __func__, sync_state); 2632 } 2633 2634 panic("%s: Unsupported pfsync_msg_version %d", 2635 __func__, sc->sc_version); 2636 } 2637 2638 static void 2639 pfsync_q_ins(struct pf_kstate *st, int sync_state, bool ref) 2640 { 2641 enum pfsync_q_id q = pfsync_sstate_to_qid(sync_state); 2642 struct pfsync_softc *sc = V_pfsyncif; 2643 size_t nlen = pfsync_qs[q].len; 2644 struct pfsync_bucket *b = pfsync_get_bucket(sc, st); 2645 2646 PFSYNC_BUCKET_LOCK_ASSERT(b); 2647 2648 KASSERT(st->sync_state == PFSYNC_S_NONE, 2649 ("%s: st->sync_state %u", __func__, st->sync_state)); 2650 KASSERT(b->b_len >= PFSYNC_MINPKT, ("pfsync pkt len is too low %zu", 2651 b->b_len)); 2652 2653 if (TAILQ_EMPTY(&b->b_qs[q])) 2654 nlen += sizeof(struct pfsync_subheader); 2655 2656 if (b->b_len + nlen > sc->sc_ifp->if_mtu) { 2657 pfsync_sendout(1, b->b_id); 2658 2659 nlen = sizeof(struct pfsync_subheader) + pfsync_qs[q].len; 2660 } 2661 2662 b->b_len += nlen; 2663 st->sync_state = pfsync_qid_sstate[q]; 2664 TAILQ_INSERT_TAIL(&b->b_qs[q], st, sync_list); 2665 if (ref) 2666 pf_ref_state(st); 2667 } 2668 2669 static void 2670 pfsync_q_del(struct pf_kstate *st, bool unref, struct pfsync_bucket *b) 2671 { 2672 enum pfsync_q_id q; 2673 2674 PFSYNC_BUCKET_LOCK_ASSERT(b); 2675 KASSERT(st->sync_state != PFSYNC_S_NONE, 2676 ("%s: st->sync_state != PFSYNC_S_NONE", __func__)); 2677 2678 q = pfsync_sstate_to_qid(st->sync_state); 2679 b->b_len -= pfsync_qs[q].len; 2680 TAILQ_REMOVE(&b->b_qs[q], st, sync_list); 2681 st->sync_state = PFSYNC_S_NONE; 2682 if (unref) 2683 pf_release_state(st); 2684 2685 if (TAILQ_EMPTY(&b->b_qs[q])) 2686 b->b_len -= sizeof(struct pfsync_subheader); 2687 } 2688 2689 static void 2690 pfsync_bulk_start(void) 2691 { 2692 struct pfsync_softc *sc = V_pfsyncif; 2693 2694 if (V_pf_status.debug >= PF_DEBUG_MISC) 2695 printf("pfsync: received bulk update request\n"); 2696 2697 PFSYNC_BLOCK(sc); 2698 2699 sc->sc_ureq_received = time_uptime; 2700 sc->sc_bulk_hashid = 0; 2701 sc->sc_bulk_stateid = 0; 2702 pfsync_bulk_status(PFSYNC_BUS_START); 2703 callout_reset(&sc->sc_bulk_tmo, 1, pfsync_bulk_update, sc); 2704 PFSYNC_BUNLOCK(sc); 2705 } 2706 2707 static void 2708 pfsync_bulk_update(void *arg) 2709 { 2710 struct pfsync_softc *sc = arg; 2711 struct pf_kstate *s; 2712 int i; 2713 2714 PFSYNC_BLOCK_ASSERT(sc); 2715 CURVNET_SET(sc->sc_ifp->if_vnet); 2716 2717 /* 2718 * Start with last state from previous invocation. 2719 * It may had gone, in this case start from the 2720 * hash slot. 2721 */ 2722 s = pf_find_state_byid(sc->sc_bulk_stateid, sc->sc_bulk_creatorid); 2723 2724 if (s != NULL) 2725 i = PF_IDHASH(s); 2726 else 2727 i = sc->sc_bulk_hashid; 2728 2729 for (; i <= V_pf_hashmask; i++) { 2730 struct pf_idhash *ih = &V_pf_idhash[i]; 2731 2732 if (s != NULL) 2733 PF_HASHROW_ASSERT(ih); 2734 else { 2735 PF_HASHROW_LOCK(ih); 2736 s = LIST_FIRST(&ih->states); 2737 } 2738 2739 for (; s; s = LIST_NEXT(s, entry)) { 2740 if (s->sync_state == PFSYNC_S_NONE && 2741 s->timeout < PFTM_MAX && 2742 s->pfsync_time <= sc->sc_ureq_received) { 2743 if (pfsync_update_state_req(s)) { 2744 /* We've filled a packet. */ 2745 sc->sc_bulk_hashid = i; 2746 sc->sc_bulk_stateid = s->id; 2747 sc->sc_bulk_creatorid = s->creatorid; 2748 PF_HASHROW_UNLOCK(ih); 2749 callout_reset(&sc->sc_bulk_tmo, 1, 2750 pfsync_bulk_update, sc); 2751 goto full; 2752 } 2753 } 2754 } 2755 PF_HASHROW_UNLOCK(ih); 2756 } 2757 2758 /* We're done. */ 2759 pfsync_bulk_status(PFSYNC_BUS_END); 2760 full: 2761 CURVNET_RESTORE(); 2762 } 2763 2764 static void 2765 pfsync_bulk_status(u_int8_t status) 2766 { 2767 struct { 2768 struct pfsync_subheader subh; 2769 struct pfsync_bus bus; 2770 } __packed r; 2771 2772 struct pfsync_softc *sc = V_pfsyncif; 2773 2774 bzero(&r, sizeof(r)); 2775 2776 r.subh.action = PFSYNC_ACT_BUS; 2777 r.subh.count = htons(1); 2778 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_BUS]++; 2779 2780 r.bus.creatorid = V_pf_status.hostid; 2781 r.bus.endtime = htonl(time_uptime - sc->sc_ureq_received); 2782 r.bus.status = status; 2783 2784 pfsync_send_plus(&r, sizeof(r)); 2785 } 2786 2787 static void 2788 pfsync_bulk_fail(void *arg) 2789 { 2790 struct pfsync_softc *sc = arg; 2791 struct pfsync_bucket *b = &sc->sc_buckets[0]; 2792 2793 CURVNET_SET(sc->sc_ifp->if_vnet); 2794 2795 PFSYNC_BLOCK_ASSERT(sc); 2796 2797 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) { 2798 /* Try again */ 2799 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, 2800 pfsync_bulk_fail, V_pfsyncif); 2801 PFSYNC_BUCKET_LOCK(b); 2802 pfsync_request_update(0, 0); 2803 PFSYNC_BUCKET_UNLOCK(b); 2804 } else { 2805 /* Pretend like the transfer was ok. */ 2806 sc->sc_ureq_sent = 0; 2807 sc->sc_bulk_tries = 0; 2808 PFSYNC_LOCK(sc); 2809 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p) 2810 (*carp_demote_adj_p)(-V_pfsync_carp_adj, 2811 "pfsync bulk fail"); 2812 sc->sc_flags |= PFSYNCF_OK; 2813 PFSYNC_UNLOCK(sc); 2814 if (V_pf_status.debug >= PF_DEBUG_MISC) 2815 printf("pfsync: failed to receive bulk update\n"); 2816 } 2817 2818 CURVNET_RESTORE(); 2819 } 2820 2821 static void 2822 pfsync_send_plus(void *plus, size_t pluslen) 2823 { 2824 struct pfsync_softc *sc = V_pfsyncif; 2825 struct pfsync_bucket *b = &sc->sc_buckets[0]; 2826 uint8_t *newplus; 2827 2828 PFSYNC_BUCKET_LOCK(b); 2829 2830 if (b->b_len + pluslen > sc->sc_ifp->if_mtu) 2831 pfsync_sendout(1, b->b_id); 2832 2833 newplus = malloc(pluslen + b->b_pluslen, M_PFSYNC, M_NOWAIT); 2834 if (newplus == NULL) 2835 goto out; 2836 2837 if (b->b_plus != NULL) { 2838 memcpy(newplus, b->b_plus, b->b_pluslen); 2839 free(b->b_plus, M_PFSYNC); 2840 } else { 2841 MPASS(b->b_pluslen == 0); 2842 } 2843 memcpy(newplus + b->b_pluslen, plus, pluslen); 2844 2845 b->b_plus = newplus; 2846 b->b_pluslen += pluslen; 2847 b->b_len += pluslen; 2848 2849 pfsync_sendout(1, b->b_id); 2850 2851 out: 2852 PFSYNC_BUCKET_UNLOCK(b); 2853 } 2854 2855 static void 2856 pfsync_timeout(void *arg) 2857 { 2858 struct pfsync_bucket *b = arg; 2859 2860 CURVNET_SET(b->b_sc->sc_ifp->if_vnet); 2861 PFSYNC_BUCKET_LOCK(b); 2862 pfsync_push(b); 2863 PFSYNC_BUCKET_UNLOCK(b); 2864 CURVNET_RESTORE(); 2865 } 2866 2867 static void 2868 pfsync_push(struct pfsync_bucket *b) 2869 { 2870 2871 PFSYNC_BUCKET_LOCK_ASSERT(b); 2872 2873 b->b_flags |= PFSYNCF_BUCKET_PUSH; 2874 swi_sched(V_pfsync_swi_cookie, 0); 2875 } 2876 2877 static void 2878 pfsync_push_all(struct pfsync_softc *sc) 2879 { 2880 int c; 2881 struct pfsync_bucket *b; 2882 2883 for (c = 0; c < pfsync_buckets; c++) { 2884 b = &sc->sc_buckets[c]; 2885 2886 PFSYNC_BUCKET_LOCK(b); 2887 pfsync_push(b); 2888 PFSYNC_BUCKET_UNLOCK(b); 2889 } 2890 } 2891 2892 static void 2893 pfsync_tx(struct pfsync_softc *sc, struct mbuf *m) 2894 { 2895 struct ip *ip; 2896 int af, error = 0; 2897 2898 ip = mtod(m, struct ip *); 2899 MPASS(ip->ip_v == IPVERSION || ip->ip_v == (IPV6_VERSION >> 4)); 2900 2901 af = ip->ip_v == IPVERSION ? AF_INET : AF_INET6; 2902 2903 /* 2904 * We distinguish between a deferral packet and our 2905 * own pfsync packet based on M_SKIP_FIREWALL 2906 * flag. This is XXX. 2907 */ 2908 switch (af) { 2909 #ifdef INET 2910 case AF_INET: 2911 if (m->m_flags & M_SKIP_FIREWALL) { 2912 error = ip_output(m, NULL, NULL, 0, 2913 NULL, NULL); 2914 } else { 2915 error = ip_output(m, NULL, NULL, 2916 IP_RAWOUTPUT, &sc->sc_imo, NULL); 2917 } 2918 break; 2919 #endif 2920 #ifdef INET6 2921 case AF_INET6: 2922 if (m->m_flags & M_SKIP_FIREWALL) { 2923 error = ip6_output(m, NULL, NULL, 0, 2924 NULL, NULL, NULL); 2925 } else { 2926 error = ip6_output(m, NULL, NULL, 0, 2927 &sc->sc_im6o, NULL, NULL); 2928 } 2929 break; 2930 #endif 2931 } 2932 2933 if (error == 0) 2934 V_pfsyncstats.pfsyncs_opackets++; 2935 else 2936 V_pfsyncstats.pfsyncs_oerrors++; 2937 2938 } 2939 2940 static void 2941 pfsyncintr(void *arg) 2942 { 2943 struct epoch_tracker et; 2944 struct pfsync_softc *sc = arg; 2945 struct pfsync_bucket *b; 2946 struct mbuf *m, *n; 2947 int c; 2948 2949 NET_EPOCH_ENTER(et); 2950 CURVNET_SET(sc->sc_ifp->if_vnet); 2951 2952 for (c = 0; c < pfsync_buckets; c++) { 2953 b = &sc->sc_buckets[c]; 2954 2955 PFSYNC_BUCKET_LOCK(b); 2956 if ((b->b_flags & PFSYNCF_BUCKET_PUSH) && b->b_len > PFSYNC_MINPKT) { 2957 pfsync_sendout(0, b->b_id); 2958 b->b_flags &= ~PFSYNCF_BUCKET_PUSH; 2959 } 2960 _IF_DEQUEUE_ALL(&b->b_snd, m); 2961 PFSYNC_BUCKET_UNLOCK(b); 2962 2963 for (; m != NULL; m = n) { 2964 n = m->m_nextpkt; 2965 m->m_nextpkt = NULL; 2966 2967 pfsync_tx(sc, m); 2968 } 2969 } 2970 CURVNET_RESTORE(); 2971 NET_EPOCH_EXIT(et); 2972 } 2973 2974 static int 2975 pfsync_multicast_setup(struct pfsync_softc *sc, struct ifnet *ifp, 2976 struct in_mfilter* imf, struct in6_mfilter* im6f) 2977 { 2978 #ifdef INET 2979 struct ip_moptions *imo = &sc->sc_imo; 2980 #endif 2981 #ifdef INET6 2982 struct ip6_moptions *im6o = &sc->sc_im6o; 2983 struct sockaddr_in6 *syncpeer_sa6 = NULL; 2984 #endif 2985 2986 if (!(ifp->if_flags & IFF_MULTICAST)) 2987 return (EADDRNOTAVAIL); 2988 2989 switch (sc->sc_sync_peer.ss_family) { 2990 #ifdef INET 2991 case AF_INET: 2992 { 2993 int error; 2994 2995 ip_mfilter_init(&imo->imo_head); 2996 imo->imo_multicast_vif = -1; 2997 if ((error = in_joingroup(ifp, 2998 &((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr, NULL, 2999 &imf->imf_inm)) != 0) 3000 return (error); 3001 3002 ip_mfilter_insert(&imo->imo_head, imf); 3003 imo->imo_multicast_ifp = ifp; 3004 imo->imo_multicast_ttl = PFSYNC_DFLTTL; 3005 imo->imo_multicast_loop = 0; 3006 break; 3007 } 3008 #endif 3009 #ifdef INET6 3010 case AF_INET6: 3011 { 3012 int error; 3013 3014 syncpeer_sa6 = (struct sockaddr_in6 *)&sc->sc_sync_peer; 3015 if ((error = in6_setscope(&syncpeer_sa6->sin6_addr, ifp, NULL))) 3016 return (error); 3017 3018 ip6_mfilter_init(&im6o->im6o_head); 3019 if ((error = in6_joingroup(ifp, &syncpeer_sa6->sin6_addr, NULL, 3020 &(im6f->im6f_in6m), 0)) != 0) 3021 return (error); 3022 3023 ip6_mfilter_insert(&im6o->im6o_head, im6f); 3024 im6o->im6o_multicast_ifp = ifp; 3025 im6o->im6o_multicast_hlim = PFSYNC_DFLTTL; 3026 im6o->im6o_multicast_loop = 0; 3027 break; 3028 } 3029 #endif 3030 } 3031 3032 return (0); 3033 } 3034 3035 static void 3036 pfsync_multicast_cleanup(struct pfsync_softc *sc) 3037 { 3038 #ifdef INET 3039 struct ip_moptions *imo = &sc->sc_imo; 3040 struct in_mfilter *imf; 3041 3042 while ((imf = ip_mfilter_first(&imo->imo_head)) != NULL) { 3043 ip_mfilter_remove(&imo->imo_head, imf); 3044 in_leavegroup(imf->imf_inm, NULL); 3045 ip_mfilter_free(imf); 3046 } 3047 imo->imo_multicast_ifp = NULL; 3048 #endif 3049 3050 #ifdef INET6 3051 struct ip6_moptions *im6o = &sc->sc_im6o; 3052 struct in6_mfilter *im6f; 3053 3054 while ((im6f = ip6_mfilter_first(&im6o->im6o_head)) != NULL) { 3055 ip6_mfilter_remove(&im6o->im6o_head, im6f); 3056 in6_leavegroup(im6f->im6f_in6m, NULL); 3057 ip6_mfilter_free(im6f); 3058 } 3059 im6o->im6o_multicast_ifp = NULL; 3060 #endif 3061 } 3062 3063 void 3064 pfsync_detach_ifnet(struct ifnet *ifp) 3065 { 3066 struct pfsync_softc *sc = V_pfsyncif; 3067 3068 if (sc == NULL) 3069 return; 3070 3071 PFSYNC_LOCK(sc); 3072 3073 if (sc->sc_sync_if == ifp) { 3074 /* We don't need mutlicast cleanup here, because the interface 3075 * is going away. We do need to ensure we don't try to do 3076 * cleanup later. 3077 */ 3078 ip_mfilter_init(&sc->sc_imo.imo_head); 3079 sc->sc_imo.imo_multicast_ifp = NULL; 3080 sc->sc_im6o.im6o_multicast_ifp = NULL; 3081 sc->sc_sync_if = NULL; 3082 } 3083 3084 PFSYNC_UNLOCK(sc); 3085 } 3086 3087 static int 3088 pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *pfsyncr, struct pfsync_kstatus *status) 3089 { 3090 struct sockaddr_storage sa; 3091 status->maxupdates = pfsyncr->pfsyncr_maxupdates; 3092 status->flags = pfsyncr->pfsyncr_defer; 3093 3094 strlcpy(status->syncdev, pfsyncr->pfsyncr_syncdev, IFNAMSIZ); 3095 3096 memset(&sa, 0, sizeof(sa)); 3097 if (pfsyncr->pfsyncr_syncpeer.s_addr != 0) { 3098 struct sockaddr_in *in = (struct sockaddr_in *)&sa; 3099 in->sin_family = AF_INET; 3100 in->sin_len = sizeof(*in); 3101 in->sin_addr.s_addr = pfsyncr->pfsyncr_syncpeer.s_addr; 3102 } 3103 status->syncpeer = sa; 3104 3105 return 0; 3106 } 3107 3108 static int 3109 pfsync_kstatus_to_softc(struct pfsync_kstatus *status, struct pfsync_softc *sc) 3110 { 3111 struct ifnet *sifp; 3112 struct in_mfilter *imf = NULL; 3113 struct in6_mfilter *im6f = NULL; 3114 int error; 3115 int c; 3116 3117 if ((status->maxupdates < 0) || (status->maxupdates > 255)) 3118 return (EINVAL); 3119 3120 if (status->syncdev[0] == '\0') 3121 sifp = NULL; 3122 else if ((sifp = ifunit_ref(status->syncdev)) == NULL) 3123 return (EINVAL); 3124 3125 switch (status->syncpeer.ss_family) { 3126 #ifdef INET 3127 case AF_UNSPEC: 3128 case AF_INET: { 3129 struct sockaddr_in *status_sin; 3130 status_sin = (struct sockaddr_in *)&(status->syncpeer); 3131 if (sifp != NULL) { 3132 if (status_sin->sin_addr.s_addr == 0 || 3133 status_sin->sin_addr.s_addr == 3134 htonl(INADDR_PFSYNC_GROUP)) { 3135 status_sin->sin_family = AF_INET; 3136 status_sin->sin_len = sizeof(*status_sin); 3137 status_sin->sin_addr.s_addr = 3138 htonl(INADDR_PFSYNC_GROUP); 3139 } 3140 3141 if (IN_MULTICAST(ntohl(status_sin->sin_addr.s_addr))) { 3142 imf = ip_mfilter_alloc(M_WAITOK, 0, 0); 3143 } 3144 } 3145 break; 3146 } 3147 #endif 3148 #ifdef INET6 3149 case AF_INET6: { 3150 struct sockaddr_in6 *status_sin6; 3151 status_sin6 = (struct sockaddr_in6*)&(status->syncpeer); 3152 if (sifp != NULL) { 3153 if (IN6_IS_ADDR_UNSPECIFIED(&status_sin6->sin6_addr) || 3154 IN6_ARE_ADDR_EQUAL(&status_sin6->sin6_addr, 3155 &in6addr_linklocal_pfsync_group)) { 3156 status_sin6->sin6_family = AF_INET6; 3157 status_sin6->sin6_len = sizeof(*status_sin6); 3158 status_sin6->sin6_addr = 3159 in6addr_linklocal_pfsync_group; 3160 } 3161 3162 if (IN6_IS_ADDR_MULTICAST(&status_sin6->sin6_addr)) { 3163 im6f = ip6_mfilter_alloc(M_WAITOK, 0, 0); 3164 } 3165 } 3166 break; 3167 } 3168 #endif 3169 } 3170 3171 PFSYNC_LOCK(sc); 3172 3173 switch (status->version) { 3174 case PFSYNC_MSG_VERSION_UNSPECIFIED: 3175 sc->sc_version = PFSYNC_MSG_VERSION_DEFAULT; 3176 break; 3177 case PFSYNC_MSG_VERSION_1301: 3178 case PFSYNC_MSG_VERSION_1400: 3179 case PFSYNC_MSG_VERSION_1500: 3180 sc->sc_version = status->version; 3181 break; 3182 default: 3183 PFSYNC_UNLOCK(sc); 3184 return (EINVAL); 3185 } 3186 3187 switch (status->syncpeer.ss_family) { 3188 case AF_INET: { 3189 struct sockaddr_in *status_sin = (struct sockaddr_in *)&(status->syncpeer); 3190 struct sockaddr_in *sc_sin = (struct sockaddr_in *)&sc->sc_sync_peer; 3191 sc_sin->sin_family = AF_INET; 3192 sc_sin->sin_len = sizeof(*sc_sin); 3193 if (status_sin->sin_addr.s_addr == 0) { 3194 sc_sin->sin_addr.s_addr = htonl(INADDR_PFSYNC_GROUP); 3195 } else { 3196 sc_sin->sin_addr.s_addr = status_sin->sin_addr.s_addr; 3197 } 3198 break; 3199 } 3200 case AF_INET6: { 3201 struct sockaddr_in6 *status_sin = (struct sockaddr_in6 *)&(status->syncpeer); 3202 struct sockaddr_in6 *sc_sin = (struct sockaddr_in6 *)&sc->sc_sync_peer; 3203 sc_sin->sin6_family = AF_INET6; 3204 sc_sin->sin6_len = sizeof(*sc_sin); 3205 if(IN6_IS_ADDR_UNSPECIFIED(&status_sin->sin6_addr)) { 3206 sc_sin->sin6_addr = in6addr_linklocal_pfsync_group; 3207 } else { 3208 sc_sin->sin6_addr = status_sin->sin6_addr; 3209 } 3210 break; 3211 } 3212 } 3213 3214 sc->sc_maxupdates = status->maxupdates; 3215 if (status->flags & PFSYNCF_DEFER) { 3216 sc->sc_flags |= PFSYNCF_DEFER; 3217 V_pfsync_defer_ptr = pfsync_defer; 3218 } else { 3219 sc->sc_flags &= ~PFSYNCF_DEFER; 3220 V_pfsync_defer_ptr = NULL; 3221 } 3222 3223 if (sifp == NULL) { 3224 if (sc->sc_sync_if) 3225 if_rele(sc->sc_sync_if); 3226 sc->sc_sync_if = NULL; 3227 pfsync_multicast_cleanup(sc); 3228 PFSYNC_UNLOCK(sc); 3229 return (0); 3230 } 3231 3232 for (c = 0; c < pfsync_buckets; c++) { 3233 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]); 3234 if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT && 3235 (sifp->if_mtu < sc->sc_ifp->if_mtu || 3236 (sc->sc_sync_if != NULL && 3237 sifp->if_mtu < sc->sc_sync_if->if_mtu) || 3238 sifp->if_mtu < MCLBYTES - sizeof(struct ip))) 3239 pfsync_sendout(1, c); 3240 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]); 3241 } 3242 3243 pfsync_multicast_cleanup(sc); 3244 3245 if (((sc->sc_sync_peer.ss_family == AF_INET) && 3246 IN_MULTICAST(ntohl(((struct sockaddr_in *) 3247 &sc->sc_sync_peer)->sin_addr.s_addr))) || 3248 ((sc->sc_sync_peer.ss_family == AF_INET6) && 3249 IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6*) 3250 &sc->sc_sync_peer)->sin6_addr))) { 3251 error = pfsync_multicast_setup(sc, sifp, imf, im6f); 3252 if (error) { 3253 if_rele(sifp); 3254 PFSYNC_UNLOCK(sc); 3255 #ifdef INET 3256 if (imf != NULL) 3257 ip_mfilter_free(imf); 3258 #endif 3259 #ifdef INET6 3260 if (im6f != NULL) 3261 ip6_mfilter_free(im6f); 3262 #endif 3263 return (error); 3264 } 3265 } 3266 if (sc->sc_sync_if) 3267 if_rele(sc->sc_sync_if); 3268 sc->sc_sync_if = sifp; 3269 3270 switch (sc->sc_sync_peer.ss_family) { 3271 #ifdef INET 3272 case AF_INET: { 3273 struct ip *ip; 3274 ip = &sc->sc_template.ipv4; 3275 bzero(ip, sizeof(*ip)); 3276 ip->ip_v = IPVERSION; 3277 ip->ip_hl = sizeof(sc->sc_template.ipv4) >> 2; 3278 ip->ip_tos = IPTOS_LOWDELAY; 3279 /* len and id are set later. */ 3280 ip->ip_off = htons(IP_DF); 3281 ip->ip_ttl = PFSYNC_DFLTTL; 3282 ip->ip_p = IPPROTO_PFSYNC; 3283 ip->ip_src.s_addr = INADDR_ANY; 3284 ip->ip_dst = ((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr; 3285 break; 3286 } 3287 #endif 3288 #ifdef INET6 3289 case AF_INET6: { 3290 struct ip6_hdr *ip6; 3291 ip6 = &sc->sc_template.ipv6; 3292 bzero(ip6, sizeof(*ip6)); 3293 ip6->ip6_vfc = IPV6_VERSION; 3294 ip6->ip6_hlim = PFSYNC_DFLTTL; 3295 ip6->ip6_nxt = IPPROTO_PFSYNC; 3296 ip6->ip6_dst = ((struct sockaddr_in6 *)&sc->sc_sync_peer)->sin6_addr; 3297 3298 struct epoch_tracker et; 3299 NET_EPOCH_ENTER(et); 3300 in6_selectsrc_addr(if_getfib(sc->sc_sync_if), &ip6->ip6_dst, 0, 3301 sc->sc_sync_if, &ip6->ip6_src, NULL); 3302 NET_EPOCH_EXIT(et); 3303 break; 3304 } 3305 #endif 3306 } 3307 3308 /* Request a full state table update. */ 3309 if ((sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p) 3310 (*carp_demote_adj_p)(V_pfsync_carp_adj, 3311 "pfsync bulk start"); 3312 sc->sc_flags &= ~PFSYNCF_OK; 3313 if (V_pf_status.debug >= PF_DEBUG_MISC) 3314 printf("pfsync: requesting bulk update\n"); 3315 PFSYNC_UNLOCK(sc); 3316 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]); 3317 pfsync_request_update(0, 0); 3318 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]); 3319 PFSYNC_BLOCK(sc); 3320 sc->sc_ureq_sent = time_uptime; 3321 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulk_fail, sc); 3322 PFSYNC_BUNLOCK(sc); 3323 return (0); 3324 } 3325 3326 static void 3327 pfsync_pointers_init(void) 3328 { 3329 3330 PF_RULES_WLOCK(); 3331 V_pfsync_state_import_ptr = pfsync_state_import; 3332 V_pfsync_insert_state_ptr = pfsync_insert_state; 3333 V_pfsync_update_state_ptr = pfsync_update_state; 3334 V_pfsync_delete_state_ptr = pfsync_delete_state; 3335 V_pfsync_clear_states_ptr = pfsync_clear_states; 3336 V_pfsync_defer_ptr = pfsync_defer; 3337 PF_RULES_WUNLOCK(); 3338 } 3339 3340 static void 3341 pfsync_pointers_uninit(void) 3342 { 3343 3344 PF_RULES_WLOCK(); 3345 V_pfsync_state_import_ptr = NULL; 3346 V_pfsync_insert_state_ptr = NULL; 3347 V_pfsync_update_state_ptr = NULL; 3348 V_pfsync_delete_state_ptr = NULL; 3349 V_pfsync_clear_states_ptr = NULL; 3350 V_pfsync_defer_ptr = NULL; 3351 PF_RULES_WUNLOCK(); 3352 } 3353 3354 static void 3355 vnet_pfsync_init(const void *unused __unused) 3356 { 3357 int error; 3358 3359 V_pfsync_cloner = if_clone_simple(pfsyncname, 3360 pfsync_clone_create, pfsync_clone_destroy, 1); 3361 error = swi_add(&V_pfsync_swi_ie, pfsyncname, pfsyncintr, V_pfsyncif, 3362 SWI_NET, INTR_MPSAFE, &V_pfsync_swi_cookie); 3363 if (error) { 3364 if_clone_detach(V_pfsync_cloner); 3365 log(LOG_INFO, "swi_add() failed in %s\n", __func__); 3366 } 3367 3368 pfsync_pointers_init(); 3369 } 3370 VNET_SYSINIT(vnet_pfsync_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY, 3371 vnet_pfsync_init, NULL); 3372 3373 static void 3374 vnet_pfsync_uninit(const void *unused __unused) 3375 { 3376 int ret __diagused; 3377 3378 pfsync_pointers_uninit(); 3379 3380 if_clone_detach(V_pfsync_cloner); 3381 ret = swi_remove(V_pfsync_swi_cookie); 3382 MPASS(ret == 0); 3383 ret = intr_event_destroy(V_pfsync_swi_ie); 3384 MPASS(ret == 0); 3385 } 3386 3387 VNET_SYSUNINIT(vnet_pfsync_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_FOURTH, 3388 vnet_pfsync_uninit, NULL); 3389 3390 static int 3391 pfsync_init(void) 3392 { 3393 int error; 3394 3395 pfsync_detach_ifnet_ptr = pfsync_detach_ifnet; 3396 3397 #ifdef INET 3398 error = ipproto_register(IPPROTO_PFSYNC, pfsync_input, NULL); 3399 if (error) 3400 return (error); 3401 #endif 3402 #ifdef INET6 3403 error = ip6proto_register(IPPROTO_PFSYNC, pfsync6_input, NULL); 3404 if (error) { 3405 ipproto_unregister(IPPROTO_PFSYNC); 3406 return (error); 3407 } 3408 #endif 3409 3410 return (0); 3411 } 3412 3413 static void 3414 pfsync_uninit(void) 3415 { 3416 pfsync_detach_ifnet_ptr = NULL; 3417 3418 #ifdef INET 3419 ipproto_unregister(IPPROTO_PFSYNC); 3420 #endif 3421 #ifdef INET6 3422 ip6proto_unregister(IPPROTO_PFSYNC); 3423 #endif 3424 } 3425 3426 static int 3427 pfsync_modevent(module_t mod, int type, void *data) 3428 { 3429 int error = 0; 3430 3431 switch (type) { 3432 case MOD_LOAD: 3433 error = pfsync_init(); 3434 break; 3435 case MOD_UNLOAD: 3436 pfsync_uninit(); 3437 break; 3438 default: 3439 error = EINVAL; 3440 break; 3441 } 3442 3443 return (error); 3444 } 3445 3446 static moduledata_t pfsync_mod = { 3447 pfsyncname, 3448 pfsync_modevent, 3449 0 3450 }; 3451 3452 #define PFSYNC_MODVER 1 3453 3454 /* Stay on FIREWALL as we depend on pf being initialized and on inetdomain. */ 3455 DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY); 3456 MODULE_VERSION(pfsync, PFSYNC_MODVER); 3457 MODULE_DEPEND(pfsync, pf, PF_MODVER, PF_MODVER, PF_MODVER); 3458