1 /*-
2 * SPDX-License-Identifier: (BSD-2-Clause AND ISC)
3 *
4 * Copyright (c) 2002 Michael Shalayeff
5 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
21 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
23 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27 * THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 /*-
31 * Copyright (c) 2009 David Gwynne <dlg@openbsd.org>
32 *
33 * Permission to use, copy, modify, and distribute this software for any
34 * purpose with or without fee is hereby granted, provided that the above
35 * copyright notice and this permission notice appear in all copies.
36 *
37 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
38 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
39 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
40 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
41 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
42 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
43 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
44 */
45
46 /*
47 * $OpenBSD: if_pfsync.c,v 1.110 2009/02/24 05:39:19 dlg Exp $
48 *
49 * Revisions picked from OpenBSD after revision 1.110 import:
50 * 1.119 - don't m_copydata() beyond the len of mbuf in pfsync_input()
51 * 1.118, 1.124, 1.148, 1.149, 1.151, 1.171 - fixes to bulk updates
52 * 1.120, 1.175 - use monotonic time_uptime
53 * 1.122 - reduce number of updates for non-TCP sessions
54 * 1.125, 1.127 - rewrite merge or stale processing
55 * 1.128 - cleanups
56 * 1.146 - bzero() mbuf before sparsely filling it with data
57 * 1.170 - SIOCSIFMTU checks
58 * 1.126, 1.142 - deferred packets processing
59 * 1.173 - correct expire time processing
60 */
61
62 #include <sys/cdefs.h>
63 #include "opt_inet.h"
64 #include "opt_inet6.h"
65 #include "opt_pf.h"
66
67 #include <sys/param.h>
68 #include <sys/bus.h>
69 #include <sys/endian.h>
70 #include <sys/interrupt.h>
71 #include <sys/kernel.h>
72 #include <sys/lock.h>
73 #include <sys/mbuf.h>
74 #include <sys/module.h>
75 #include <sys/mutex.h>
76 #include <sys/nv.h>
77 #include <sys/priv.h>
78 #include <sys/smp.h>
79 #include <sys/socket.h>
80 #include <sys/sockio.h>
81 #include <sys/sysctl.h>
82 #include <sys/syslog.h>
83
84 #include <net/bpf.h>
85 #include <net/if.h>
86 #include <net/if_var.h>
87 #include <net/if_clone.h>
88 #include <net/if_private.h>
89 #include <net/if_types.h>
90 #include <net/vnet.h>
91 #include <net/pfvar.h>
92 #include <net/route.h>
93 #include <net/if_pfsync.h>
94
95 #include <netinet/if_ether.h>
96 #include <netinet/in.h>
97 #include <netinet/in_var.h>
98 #include <netinet6/in6_var.h>
99 #include <netinet/ip.h>
100 #include <netinet/ip6.h>
101 #include <netinet/ip_carp.h>
102 #include <netinet/ip_var.h>
103 #include <netinet/tcp.h>
104 #include <netinet/tcp_fsm.h>
105 #include <netinet/tcp_seq.h>
106
107 #include <netinet/ip6.h>
108 #include <netinet6/ip6_var.h>
109 #include <netinet6/scope6_var.h>
110
111 #include <netpfil/pf/pfsync_nv.h>
112
113 struct pfsync_bucket;
114 struct pfsync_softc;
115
116 union inet_template {
117 struct ip ipv4;
118 struct ip6_hdr ipv6;
119 };
120
121 #define PFSYNC_MINPKT ( \
122 sizeof(union inet_template) + \
123 sizeof(struct pfsync_header) + \
124 sizeof(struct pfsync_subheader) )
125
126 static int pfsync_upd_tcp(struct pf_kstate *, struct pf_state_peer_export *,
127 struct pf_state_peer_export *);
128 static int pfsync_in_clr(struct mbuf *, int, int, int, int);
129 static int pfsync_in_ins(struct mbuf *, int, int, int, int);
130 static int pfsync_in_iack(struct mbuf *, int, int, int, int);
131 static int pfsync_in_upd(struct mbuf *, int, int, int, int);
132 static int pfsync_in_upd_c(struct mbuf *, int, int, int, int);
133 static int pfsync_in_ureq(struct mbuf *, int, int, int, int);
134 static int pfsync_in_del_c(struct mbuf *, int, int, int, int);
135 static int pfsync_in_bus(struct mbuf *, int, int, int, int);
136 static int pfsync_in_tdb(struct mbuf *, int, int, int, int);
137 static int pfsync_in_eof(struct mbuf *, int, int, int, int);
138 static int pfsync_in_error(struct mbuf *, int, int, int, int);
139
140 static int (*pfsync_acts[])(struct mbuf *, int, int, int, int) = {
141 pfsync_in_clr, /* PFSYNC_ACT_CLR */
142 pfsync_in_ins, /* PFSYNC_ACT_INS_1301 */
143 pfsync_in_iack, /* PFSYNC_ACT_INS_ACK */
144 pfsync_in_upd, /* PFSYNC_ACT_UPD_1301 */
145 pfsync_in_upd_c, /* PFSYNC_ACT_UPD_C */
146 pfsync_in_ureq, /* PFSYNC_ACT_UPD_REQ */
147 pfsync_in_error, /* PFSYNC_ACT_DEL */
148 pfsync_in_del_c, /* PFSYNC_ACT_DEL_C */
149 pfsync_in_error, /* PFSYNC_ACT_INS_F */
150 pfsync_in_error, /* PFSYNC_ACT_DEL_F */
151 pfsync_in_bus, /* PFSYNC_ACT_BUS */
152 pfsync_in_tdb, /* PFSYNC_ACT_TDB */
153 pfsync_in_eof, /* PFSYNC_ACT_EOF */
154 pfsync_in_ins, /* PFSYNC_ACT_INS_1400 */
155 pfsync_in_upd, /* PFSYNC_ACT_UPD_1400 */
156 pfsync_in_ins, /* PFSYNC_ACT_INS_1500 */
157 pfsync_in_upd, /* PFSYNC_ACT_UPD_1500 */
158 };
159
160 struct pfsync_q {
161 void (*write)(struct pf_kstate *, void *);
162 size_t len;
163 u_int8_t action;
164 };
165
166 /* We have the following sync queues */
167 enum pfsync_q_id {
168 PFSYNC_Q_INS_1301,
169 PFSYNC_Q_INS_1400,
170 PFSYNC_Q_INS_1500,
171 PFSYNC_Q_IACK,
172 PFSYNC_Q_UPD_1301,
173 PFSYNC_Q_UPD_1400,
174 PFSYNC_Q_UPD_1500,
175 PFSYNC_Q_UPD_C,
176 PFSYNC_Q_DEL_C,
177 PFSYNC_Q_COUNT,
178 };
179
180 /* Functions for building messages for given queue */
181 static void pfsync_out_state_1301(struct pf_kstate *, void *);
182 static void pfsync_out_state_1400(struct pf_kstate *, void *);
183 static void pfsync_out_state_1500(struct pf_kstate *, void *);
184 static void pfsync_out_iack(struct pf_kstate *, void *);
185 static void pfsync_out_upd_c(struct pf_kstate *, void *);
186 static void pfsync_out_del_c(struct pf_kstate *, void *);
187
188 /* Attach those functions to queue */
189 static struct pfsync_q pfsync_qs[] = {
190 { pfsync_out_state_1301, sizeof(struct pfsync_state_1301), PFSYNC_ACT_INS_1301 },
191 { pfsync_out_state_1400, sizeof(struct pfsync_state_1400), PFSYNC_ACT_INS_1400 },
192 { pfsync_out_state_1500, sizeof(struct pfsync_state_1500), PFSYNC_ACT_INS_1500 },
193 { pfsync_out_iack, sizeof(struct pfsync_ins_ack), PFSYNC_ACT_INS_ACK },
194 { pfsync_out_state_1301, sizeof(struct pfsync_state_1301), PFSYNC_ACT_UPD_1301 },
195 { pfsync_out_state_1400, sizeof(struct pfsync_state_1400), PFSYNC_ACT_UPD_1400 },
196 { pfsync_out_state_1500, sizeof(struct pfsync_state_1500), PFSYNC_ACT_UPD_1500 },
197 { pfsync_out_upd_c, sizeof(struct pfsync_upd_c), PFSYNC_ACT_UPD_C },
198 { pfsync_out_del_c, sizeof(struct pfsync_del_c), PFSYNC_ACT_DEL_C }
199 };
200
201 /* Map queue to pf_kstate->sync_state */
202 static u_int8_t pfsync_qid_sstate[] = {
203 PFSYNC_S_INS, /* PFSYNC_Q_INS_1301 */
204 PFSYNC_S_INS, /* PFSYNC_Q_INS_1400 */
205 PFSYNC_S_INS, /* PFSYNC_Q_INS_1500 */
206 PFSYNC_S_IACK, /* PFSYNC_Q_IACK */
207 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1301 */
208 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1400 */
209 PFSYNC_S_UPD, /* PFSYNC_Q_UPD_1500 */
210 PFSYNC_S_UPD_C, /* PFSYNC_Q_UPD_C */
211 PFSYNC_S_DEL_C, /* PFSYNC_Q_DEL_C */
212 };
213
214 /* Map pf_kstate->sync_state to queue */
215 static enum pfsync_q_id pfsync_sstate_to_qid(u_int8_t);
216
217 static void pfsync_q_ins(struct pf_kstate *, int sync_state, bool);
218 static void pfsync_q_del(struct pf_kstate *, bool, struct pfsync_bucket *);
219
220 static void pfsync_update_state(struct pf_kstate *);
221 static void pfsync_tx(struct pfsync_softc *, struct mbuf *);
222
223 struct pfsync_upd_req_item {
224 TAILQ_ENTRY(pfsync_upd_req_item) ur_entry;
225 struct pfsync_upd_req ur_msg;
226 };
227
228 struct pfsync_deferral {
229 struct pfsync_softc *pd_sc;
230 TAILQ_ENTRY(pfsync_deferral) pd_entry;
231 struct callout pd_tmo;
232
233 struct pf_kstate *pd_st;
234 struct mbuf *pd_m;
235 };
236
237 struct pfsync_bucket
238 {
239 int b_id;
240 struct pfsync_softc *b_sc;
241 struct mtx b_mtx;
242 struct callout b_tmo;
243 int b_flags;
244 #define PFSYNCF_BUCKET_PUSH 0x00000001
245
246 size_t b_len;
247 TAILQ_HEAD(, pf_kstate) b_qs[PFSYNC_Q_COUNT];
248 TAILQ_HEAD(, pfsync_upd_req_item) b_upd_req_list;
249 TAILQ_HEAD(, pfsync_deferral) b_deferrals;
250 u_int b_deferred;
251 uint8_t *b_plus;
252 size_t b_pluslen;
253
254 struct ifaltq b_snd;
255 };
256
257 struct pfsync_softc {
258 /* Configuration */
259 struct ifnet *sc_ifp;
260 struct ifnet *sc_sync_if;
261 struct ip_moptions sc_imo;
262 struct ip6_moptions sc_im6o;
263 struct sockaddr_storage sc_sync_peer;
264 uint32_t sc_flags;
265 uint8_t sc_maxupdates;
266 union inet_template sc_template;
267 struct mtx sc_mtx;
268 uint32_t sc_version;
269
270 /* Queued data */
271 struct pfsync_bucket *sc_buckets;
272
273 /* Bulk update info */
274 struct mtx sc_bulk_mtx;
275 uint32_t sc_ureq_sent;
276 int sc_bulk_tries;
277 uint32_t sc_ureq_received;
278 int sc_bulk_hashid;
279 uint64_t sc_bulk_stateid;
280 uint32_t sc_bulk_creatorid;
281 struct callout sc_bulk_tmo;
282 struct callout sc_bulkfail_tmo;
283 };
284
285 #define PFSYNC_LOCK(sc) mtx_lock(&(sc)->sc_mtx)
286 #define PFSYNC_UNLOCK(sc) mtx_unlock(&(sc)->sc_mtx)
287 #define PFSYNC_LOCK_ASSERT(sc) mtx_assert(&(sc)->sc_mtx, MA_OWNED)
288
289 #define PFSYNC_BUCKET_LOCK(b) mtx_lock(&(b)->b_mtx)
290 #define PFSYNC_BUCKET_UNLOCK(b) mtx_unlock(&(b)->b_mtx)
291 #define PFSYNC_BUCKET_LOCK_ASSERT(b) mtx_assert(&(b)->b_mtx, MA_OWNED)
292
293 #define PFSYNC_BLOCK(sc) mtx_lock(&(sc)->sc_bulk_mtx)
294 #define PFSYNC_BUNLOCK(sc) mtx_unlock(&(sc)->sc_bulk_mtx)
295 #define PFSYNC_BLOCK_ASSERT(sc) mtx_assert(&(sc)->sc_bulk_mtx, MA_OWNED)
296
297 #define PFSYNC_DEFER_TIMEOUT 20
298
299 static const char pfsyncname[] = "pfsync";
300 static MALLOC_DEFINE(M_PFSYNC, pfsyncname, "pfsync(4) data");
301 VNET_DEFINE_STATIC(struct pfsync_softc *, pfsyncif) = NULL;
302 #define V_pfsyncif VNET(pfsyncif)
303 VNET_DEFINE_STATIC(void *, pfsync_swi_cookie) = NULL;
304 #define V_pfsync_swi_cookie VNET(pfsync_swi_cookie)
305 VNET_DEFINE_STATIC(struct intr_event *, pfsync_swi_ie);
306 #define V_pfsync_swi_ie VNET(pfsync_swi_ie)
307 VNET_DEFINE_STATIC(struct pfsyncstats, pfsyncstats);
308 #define V_pfsyncstats VNET(pfsyncstats)
309 VNET_DEFINE_STATIC(int, pfsync_carp_adj) = CARP_MAXSKEW;
310 #define V_pfsync_carp_adj VNET(pfsync_carp_adj)
311 VNET_DEFINE_STATIC(unsigned int, pfsync_defer_timeout) = PFSYNC_DEFER_TIMEOUT;
312 #define V_pfsync_defer_timeout VNET(pfsync_defer_timeout)
313
314 static void pfsync_timeout(void *);
315 static void pfsync_push(struct pfsync_bucket *);
316 static void pfsync_push_all(struct pfsync_softc *);
317 static void pfsyncintr(void *);
318 static int pfsync_multicast_setup(struct pfsync_softc *, struct ifnet *,
319 struct in_mfilter *, struct in6_mfilter *);
320 static void pfsync_multicast_cleanup(struct pfsync_softc *);
321 static void pfsync_pointers_init(void);
322 static void pfsync_pointers_uninit(void);
323 static int pfsync_init(void);
324 static void pfsync_uninit(void);
325
326 static unsigned long pfsync_buckets;
327
328 SYSCTL_NODE(_net, OID_AUTO, pfsync, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
329 "PFSYNC");
330 SYSCTL_STRUCT(_net_pfsync, OID_AUTO, stats, CTLFLAG_VNET | CTLFLAG_RW,
331 &VNET_NAME(pfsyncstats), pfsyncstats,
332 "PFSYNC statistics (struct pfsyncstats, net/if_pfsync.h)");
333 SYSCTL_INT(_net_pfsync, OID_AUTO, carp_demotion_factor, CTLFLAG_VNET | CTLFLAG_RW,
334 &VNET_NAME(pfsync_carp_adj), 0, "pfsync's CARP demotion factor adjustment");
335 SYSCTL_ULONG(_net_pfsync, OID_AUTO, pfsync_buckets, CTLFLAG_RDTUN,
336 &pfsync_buckets, 0, "Number of pfsync hash buckets");
337 SYSCTL_UINT(_net_pfsync, OID_AUTO, defer_delay, CTLFLAG_VNET | CTLFLAG_RW,
338 &VNET_NAME(pfsync_defer_timeout), 0, "Deferred packet timeout (in ms)");
339
340 static int pfsync_clone_create(struct if_clone *, int, caddr_t);
341 static void pfsync_clone_destroy(struct ifnet *);
342 static int pfsync_alloc_scrub_memory(struct pf_state_peer_export *,
343 struct pf_state_peer *);
344 static int pfsyncoutput(struct ifnet *, struct mbuf *,
345 const struct sockaddr *, struct route *);
346 static int pfsyncioctl(struct ifnet *, u_long, caddr_t);
347
348 static int pfsync_defer(struct pf_kstate *, struct mbuf *);
349 static void pfsync_undefer(struct pfsync_deferral *, int);
350 static void pfsync_undefer_state_locked(struct pf_kstate *, int);
351 static void pfsync_undefer_state(struct pf_kstate *, int);
352 static void pfsync_defer_tmo(void *);
353
354 static void pfsync_request_update(u_int32_t, u_int64_t);
355 static bool pfsync_update_state_req(struct pf_kstate *);
356
357 static void pfsync_drop_all(struct pfsync_softc *);
358 static void pfsync_drop(struct pfsync_softc *, int);
359 static void pfsync_sendout(int, int);
360 static void pfsync_send_plus(void *, size_t);
361
362 static void pfsync_bulk_start(void);
363 static void pfsync_bulk_status(u_int8_t);
364 static void pfsync_bulk_update(void *);
365 static void pfsync_bulk_fail(void *);
366
367 static void pfsync_detach_ifnet(struct ifnet *);
368
369 static int pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *,
370 struct pfsync_kstatus *);
371 static int pfsync_kstatus_to_softc(struct pfsync_kstatus *,
372 struct pfsync_softc *);
373
374 #ifdef IPSEC
375 static void pfsync_update_net_tdb(struct pfsync_tdb *);
376 #endif
377 static struct pfsync_bucket *pfsync_get_bucket(struct pfsync_softc *,
378 struct pf_kstate *);
379
380 #define PFSYNC_MAX_BULKTRIES 12
381
382 VNET_DEFINE(struct if_clone *, pfsync_cloner);
383 #define V_pfsync_cloner VNET(pfsync_cloner)
384
385 const struct in6_addr in6addr_linklocal_pfsync_group =
386 {{{ 0xff, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
387 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0 }}};
388 static int
pfsync_clone_create(struct if_clone * ifc,int unit,caddr_t param)389 pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param)
390 {
391 struct pfsync_softc *sc;
392 struct ifnet *ifp;
393 struct pfsync_bucket *b;
394 int c;
395 enum pfsync_q_id q;
396
397 if (unit != 0)
398 return (EINVAL);
399
400 if (! pfsync_buckets)
401 pfsync_buckets = mp_ncpus * 2;
402
403 sc = malloc(sizeof(struct pfsync_softc), M_PFSYNC, M_WAITOK | M_ZERO);
404 sc->sc_flags |= PFSYNCF_OK;
405 sc->sc_maxupdates = 128;
406 sc->sc_version = PFSYNC_MSG_VERSION_DEFAULT;
407 sc->sc_buckets = mallocarray(pfsync_buckets, sizeof(*sc->sc_buckets),
408 M_PFSYNC, M_ZERO | M_WAITOK);
409 for (c = 0; c < pfsync_buckets; c++) {
410 b = &sc->sc_buckets[c];
411 mtx_init(&b->b_mtx, "pfsync bucket", NULL, MTX_DEF);
412
413 b->b_id = c;
414 b->b_sc = sc;
415 b->b_len = PFSYNC_MINPKT;
416
417 for (q = 0; q < PFSYNC_Q_COUNT; q++)
418 TAILQ_INIT(&b->b_qs[q]);
419
420 TAILQ_INIT(&b->b_upd_req_list);
421 TAILQ_INIT(&b->b_deferrals);
422
423 callout_init(&b->b_tmo, 1);
424
425 b->b_snd.ifq_maxlen = ifqmaxlen;
426 }
427
428 ifp = sc->sc_ifp = if_alloc(IFT_PFSYNC);
429 if_initname(ifp, pfsyncname, unit);
430 ifp->if_softc = sc;
431 ifp->if_ioctl = pfsyncioctl;
432 ifp->if_output = pfsyncoutput;
433 ifp->if_hdrlen = sizeof(struct pfsync_header);
434 ifp->if_mtu = ETHERMTU;
435 mtx_init(&sc->sc_mtx, pfsyncname, NULL, MTX_DEF);
436 mtx_init(&sc->sc_bulk_mtx, "pfsync bulk", NULL, MTX_DEF);
437 callout_init_mtx(&sc->sc_bulk_tmo, &sc->sc_bulk_mtx, 0);
438 callout_init_mtx(&sc->sc_bulkfail_tmo, &sc->sc_bulk_mtx, 0);
439
440 if_attach(ifp);
441
442 bpfattach(ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
443
444 V_pfsyncif = sc;
445
446 return (0);
447 }
448
449 static void
pfsync_clone_destroy(struct ifnet * ifp)450 pfsync_clone_destroy(struct ifnet *ifp)
451 {
452 struct pfsync_softc *sc = ifp->if_softc;
453 struct pfsync_bucket *b;
454 int c, ret;
455
456 for (c = 0; c < pfsync_buckets; c++) {
457 b = &sc->sc_buckets[c];
458 /*
459 * At this stage, everything should have already been
460 * cleared by pfsync_uninit(), and we have only to
461 * drain callouts.
462 */
463 PFSYNC_BUCKET_LOCK(b);
464 while (b->b_deferred > 0) {
465 struct pfsync_deferral *pd =
466 TAILQ_FIRST(&b->b_deferrals);
467
468 ret = callout_stop(&pd->pd_tmo);
469 if (ret > 0) {
470 pfsync_undefer(pd, 1);
471 } else {
472 PFSYNC_BUCKET_UNLOCK(b);
473 callout_drain(&pd->pd_tmo);
474 PFSYNC_BUCKET_LOCK(b);
475 }
476 }
477 MPASS(b->b_deferred == 0);
478 MPASS(TAILQ_EMPTY(&b->b_deferrals));
479 PFSYNC_BUCKET_UNLOCK(b);
480
481 free(b->b_plus, M_PFSYNC);
482 b->b_plus = NULL;
483 b->b_pluslen = 0;
484
485 callout_drain(&b->b_tmo);
486 }
487
488 callout_drain(&sc->sc_bulkfail_tmo);
489 callout_drain(&sc->sc_bulk_tmo);
490
491 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
492 (*carp_demote_adj_p)(-V_pfsync_carp_adj, "pfsync destroy");
493 bpfdetach(ifp);
494 if_detach(ifp);
495
496 pfsync_drop_all(sc);
497
498 if_free(ifp);
499 pfsync_multicast_cleanup(sc);
500 mtx_destroy(&sc->sc_mtx);
501 mtx_destroy(&sc->sc_bulk_mtx);
502
503 for (c = 0; c < pfsync_buckets; c++) {
504 b = &sc->sc_buckets[c];
505 mtx_destroy(&b->b_mtx);
506 }
507 free(sc->sc_buckets, M_PFSYNC);
508 free(sc, M_PFSYNC);
509
510 V_pfsyncif = NULL;
511 }
512
513 static int
pfsync_alloc_scrub_memory(struct pf_state_peer_export * s,struct pf_state_peer * d)514 pfsync_alloc_scrub_memory(struct pf_state_peer_export *s,
515 struct pf_state_peer *d)
516 {
517 if (s->scrub.scrub_flag && d->scrub == NULL) {
518 d->scrub = uma_zalloc(V_pf_state_scrub_z, M_NOWAIT | M_ZERO);
519 if (d->scrub == NULL)
520 return (ENOMEM);
521 }
522
523 return (0);
524 }
525
526 static int
pfsync_state_import(union pfsync_state_union * sp,int flags,int msg_version)527 pfsync_state_import(union pfsync_state_union *sp, int flags, int msg_version)
528 {
529 struct pfsync_softc *sc = V_pfsyncif;
530 #ifndef __NO_STRICT_ALIGNMENT
531 struct pfsync_state_key key[2];
532 #endif
533 struct pfsync_state_key *kw, *ks;
534 struct pf_kstate *st = NULL;
535 struct pf_state_key *skw = NULL, *sks = NULL;
536 struct pf_krule *r = NULL;
537 struct pfi_kkif *kif, *orig_kif;
538 struct pfi_kkif *rt_kif = NULL;
539 struct pf_kpooladdr *rpool_first;
540 int error;
541 int n = 0;
542 sa_family_t rt_af = 0;
543 uint8_t rt = 0;
544 sa_family_t wire_af, stack_af;
545 u_int8_t wire_proto, stack_proto;
546
547 PF_RULES_RASSERT();
548
549 if (strnlen(sp->pfs_1301.ifname, IFNAMSIZ) == IFNAMSIZ)
550 return (EINVAL);
551
552 if (sp->pfs_1301.creatorid == 0) {
553 if (V_pf_status.debug >= PF_DEBUG_MISC)
554 printf("%s: invalid creator id: %08x\n", __func__,
555 ntohl(sp->pfs_1301.creatorid));
556 return (EINVAL);
557 }
558
559 /*
560 * Check interfaces early on. Do it before allocating memory etc.
561 * Because there is a high chance there will be a lot more such states.
562 */
563 if ((kif = orig_kif = pfi_kkif_find(sp->pfs_1301.ifname)) == NULL) {
564 if (V_pf_status.debug >= PF_DEBUG_MISC)
565 printf("%s: unknown interface: %s\n", __func__,
566 sp->pfs_1301.ifname);
567 if (flags & PFSYNC_SI_IOCTL)
568 return (EINVAL);
569 return (0); /* skip this state */
570 }
571
572 /*
573 * States created with floating interface policy can be synchronized to
574 * hosts with different interfaces, because they are bound to V_pfi_all.
575 * But s->orig_kif still points to a real interface. Don't abort
576 * importing the state if orig_kif does not exists on the importing host
577 * but the state is not interface-bound.
578 */
579 if (msg_version == PFSYNC_MSG_VERSION_1500) {
580 orig_kif = pfi_kkif_find(sp->pfs_1500.orig_ifname);
581 if (orig_kif == NULL) {
582 if (kif == V_pfi_all) {
583 orig_kif = kif;
584 } else {
585 if (V_pf_status.debug >= PF_DEBUG_MISC)
586 printf("%s: unknown original interface:"
587 " %s\n", __func__,
588 sp->pfs_1500.orig_ifname);
589 if (flags & PFSYNC_SI_IOCTL)
590 return (EINVAL);
591 return (0); /* skip this state */
592 }
593 }
594 }
595
596 /*
597 * If the ruleset checksums match or the state is coming from the ioctl,
598 * it's safe to associate the state with the rule of that number.
599 */
600 if (sp->pfs_1301.rule != htonl(-1) && sp->pfs_1301.anchor == htonl(-1) &&
601 (flags & (PFSYNC_SI_IOCTL | PFSYNC_SI_CKSUM)) && ntohl(sp->pfs_1301.rule) <
602 pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount) {
603 TAILQ_FOREACH(r, pf_main_ruleset.rules[
604 PF_RULESET_FILTER].active.ptr, entries)
605 if (ntohl(sp->pfs_1301.rule) == n++)
606 break;
607 } else
608 r = &V_pf_default_rule;
609
610 switch (msg_version) {
611 case PFSYNC_MSG_VERSION_1301:
612 /*
613 * On FreeBSD <= 13 the routing interface and routing operation
614 * are not sent over pfsync. If the ruleset is identical,
615 * though, we might be able to recover the routing information
616 * from the local ruleset.
617 */
618 if (r != &V_pf_default_rule) {
619 struct pf_kpool *pool = &r->route;
620
621 /* Backwards compatibility. */
622 if (TAILQ_EMPTY(&pool->list))
623 pool = &r->rdr;
624
625 /*
626 * The ruleset is identical, try to recover. If the rule
627 * has a redirection pool with a single interface, there
628 * is a chance that this interface is identical as on
629 * the pfsync peer. If there's more than one interface,
630 * give up, as we can't be sure that we will pick the
631 * same one as the pfsync peer did.
632 */
633 rpool_first = TAILQ_FIRST(&(pool->list));
634 if ((rpool_first == NULL) ||
635 (TAILQ_NEXT(rpool_first, entries) != NULL)) {
636 DPFPRINTF(PF_DEBUG_MISC,
637 "%s: can't recover routing information "
638 "because of empty or bad redirection pool",
639 __func__);
640 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0);
641 }
642 rt = r->rt;
643 rt_kif = rpool_first->kif;
644 /*
645 * Guess the AF of the route address, FreeBSD 13 does
646 * not support af-to nor prefer-ipv6-nexthop
647 * so it should be safe.
648 */
649 rt_af = r->af;
650 } else if (!PF_AZERO(&sp->pfs_1301.rt_addr, sp->pfs_1301.af)) {
651 /*
652 * Ruleset different, routing *supposedly* requested,
653 * give up on recovering.
654 */
655 DPFPRINTF(PF_DEBUG_MISC,
656 "%s: can't recover routing information "
657 "because of different ruleset", __func__);
658 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0);
659 }
660 wire_af = stack_af = sp->pfs_1301.af;
661 wire_proto = stack_proto = sp->pfs_1301.proto;
662 break;
663 case PFSYNC_MSG_VERSION_1400:
664 /*
665 * On FreeBSD 14 we're not taking any chances.
666 * We use the information synced to us.
667 */
668 if (sp->pfs_1400.rt) {
669 rt_kif = pfi_kkif_find(sp->pfs_1400.rt_ifname);
670 if (rt_kif == NULL) {
671 DPFPRINTF(PF_DEBUG_MISC,
672 "%s: unknown route interface: %s",
673 __func__, sp->pfs_1400.rt_ifname);
674 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0);
675 }
676 rt = sp->pfs_1400.rt;
677 /*
678 * Guess the AF of the route address, FreeBSD 14 does
679 * not support af-to nor prefer-ipv6-nexthop
680 * so it should be safe.
681 */
682 rt_af = sp->pfs_1400.af;
683 }
684 wire_af = stack_af = sp->pfs_1400.af;
685 wire_proto = stack_proto = sp->pfs_1400.proto;
686 break;
687 case PFSYNC_MSG_VERSION_1500:
688 /*
689 * On FreeBSD 15 and above we're not taking any chances.
690 * We use the information synced to us.
691 */
692 if (sp->pfs_1500.rt) {
693 rt_kif = pfi_kkif_find(sp->pfs_1500.rt_ifname);
694 if (rt_kif == NULL) {
695 DPFPRINTF(PF_DEBUG_MISC,
696 "%s: unknown route interface: %s",
697 __func__, sp->pfs_1500.rt_ifname);
698 return ((flags & PFSYNC_SI_IOCTL) ? EINVAL : 0);
699 }
700 rt = sp->pfs_1500.rt;
701 rt_af = sp->pfs_1500.rt_af;
702 }
703 wire_af = sp->pfs_1500.wire_af;
704 stack_af = sp->pfs_1500.stack_af;
705 wire_proto = sp->pfs_1500.wire_proto;
706 stack_proto = sp->pfs_1500.stack_proto;
707 break;
708 }
709
710 if ((r->max_states &&
711 counter_u64_fetch(r->states_cur) >= r->max_states))
712 goto cleanup;
713
714 /*
715 * XXXGL: consider M_WAITOK in ioctl path after.
716 */
717 st = pf_alloc_state(M_NOWAIT);
718 if (__predict_false(st == NULL))
719 goto cleanup;
720
721 if ((skw = uma_zalloc(V_pf_state_key_z, M_NOWAIT)) == NULL)
722 goto cleanup;
723
724 #ifndef __NO_STRICT_ALIGNMENT
725 bcopy(&sp->pfs_1301.key, key, sizeof(struct pfsync_state_key) * 2);
726 kw = &key[PF_SK_WIRE];
727 ks = &key[PF_SK_STACK];
728 #else
729 kw = &sp->pfs_1301.key[PF_SK_WIRE];
730 ks = &sp->pfs_1301.key[PF_SK_STACK];
731 #endif
732
733 if (wire_af != stack_af ||
734 PF_ANEQ(&kw->addr[0], &ks->addr[0], wire_af) ||
735 PF_ANEQ(&kw->addr[1], &ks->addr[1], wire_af) ||
736 kw->port[0] != ks->port[0] ||
737 kw->port[1] != ks->port[1]) {
738 sks = uma_zalloc(V_pf_state_key_z, M_NOWAIT);
739 if (sks == NULL)
740 goto cleanup;
741 } else
742 sks = skw;
743
744 /* allocate memory for scrub info */
745 if (pfsync_alloc_scrub_memory(&sp->pfs_1301.src, &st->src) ||
746 pfsync_alloc_scrub_memory(&sp->pfs_1301.dst, &st->dst))
747 goto cleanup;
748
749 /* Copy to state key(s). */
750 skw->addr[0] = kw->addr[0];
751 skw->addr[1] = kw->addr[1];
752 skw->port[0] = kw->port[0];
753 skw->port[1] = kw->port[1];
754 skw->proto = wire_proto;
755 skw->af = wire_af;
756 if (sks != skw) {
757 sks->addr[0] = ks->addr[0];
758 sks->addr[1] = ks->addr[1];
759 sks->port[0] = ks->port[0];
760 sks->port[1] = ks->port[1];
761 sks->proto = stack_proto;
762 sks->af = stack_af;
763 }
764
765 /* copy to state */
766 st->creation = (time_uptime - ntohl(sp->pfs_1301.creation)) * 1000;
767 st->act.rt = rt;
768 st->act.rt_kif = rt_kif;
769 st->act.rt_af = rt_af;
770
771 switch (msg_version) {
772 case PFSYNC_MSG_VERSION_1301:
773 st->state_flags = sp->pfs_1301.state_flags;
774 st->direction = sp->pfs_1301.direction;
775 st->act.log = sp->pfs_1301.log;
776 st->timeout = sp->pfs_1301.timeout;
777 if (rt)
778 bcopy(&sp->pfs_1301.rt_addr, &st->act.rt_addr,
779 sizeof(st->act.rt_addr));
780 /*
781 * In FreeBSD 13 pfsync lacks many attributes. Copy them
782 * from the rule if possible. If rule can't be matched
783 * clear any set options as we can't recover their
784 * parameters.
785 */
786 if (r == &V_pf_default_rule) {
787 st->state_flags &= ~PFSTATE_SETMASK;
788 } else {
789 /*
790 * Similar to pf_rule_to_actions(). This code
791 * won't set the actions properly if they come
792 * from multiple "match" rules as only rule
793 * creating the state is send over pfsync.
794 */
795 st->act.qid = r->qid;
796 st->act.pqid = r->pqid;
797 st->act.rtableid = r->rtableid;
798 if (r->scrub_flags & PFSTATE_SETTOS)
799 st->act.set_tos = r->set_tos;
800 st->act.min_ttl = r->min_ttl;
801 st->act.max_mss = r->max_mss;
802 st->state_flags |= (r->scrub_flags &
803 (PFSTATE_NODF|PFSTATE_RANDOMID|
804 PFSTATE_SETTOS|PFSTATE_SCRUB_TCP|
805 PFSTATE_SETPRIO));
806 if (r->dnpipe || r->dnrpipe) {
807 if (r->free_flags & PFRULE_DN_IS_PIPE)
808 st->state_flags |= PFSTATE_DN_IS_PIPE;
809 else
810 st->state_flags &= ~PFSTATE_DN_IS_PIPE;
811 }
812 st->act.dnpipe = r->dnpipe;
813 st->act.dnrpipe = r->dnrpipe;
814 }
815 break;
816 case PFSYNC_MSG_VERSION_1400:
817 st->state_flags = ntohs(sp->pfs_1400.state_flags);
818 st->direction = sp->pfs_1400.direction;
819 st->act.log = sp->pfs_1400.log;
820 st->timeout = sp->pfs_1400.timeout;
821 st->act.qid = ntohs(sp->pfs_1400.qid);
822 st->act.pqid = ntohs(sp->pfs_1400.pqid);
823 st->act.dnpipe = ntohs(sp->pfs_1400.dnpipe);
824 st->act.dnrpipe = ntohs(sp->pfs_1400.dnrpipe);
825 st->act.rtableid = ntohl(sp->pfs_1400.rtableid);
826 st->act.min_ttl = sp->pfs_1400.min_ttl;
827 st->act.set_tos = sp->pfs_1400.set_tos;
828 st->act.max_mss = ntohs(sp->pfs_1400.max_mss);
829 st->act.set_prio[0] = sp->pfs_1400.set_prio[0];
830 st->act.set_prio[1] = sp->pfs_1400.set_prio[1];
831 if (rt)
832 bcopy(&sp->pfs_1400.rt_addr, &st->act.rt_addr,
833 sizeof(st->act.rt_addr));
834 break;
835 case PFSYNC_MSG_VERSION_1500:
836 st->state_flags = ntohs(sp->pfs_1500.state_flags);
837 st->direction = sp->pfs_1500.direction;
838 st->act.log = sp->pfs_1500.log;
839 st->timeout = sp->pfs_1500.timeout;
840 st->act.qid = ntohs(sp->pfs_1500.qid);
841 st->act.pqid = ntohs(sp->pfs_1500.pqid);
842 st->act.dnpipe = ntohs(sp->pfs_1500.dnpipe);
843 st->act.dnrpipe = ntohs(sp->pfs_1500.dnrpipe);
844 st->act.rtableid = ntohl(sp->pfs_1500.rtableid);
845 st->act.min_ttl = sp->pfs_1500.min_ttl;
846 st->act.set_tos = sp->pfs_1500.set_tos;
847 st->act.max_mss = ntohs(sp->pfs_1500.max_mss);
848 st->act.set_prio[0] = sp->pfs_1500.set_prio[0];
849 st->act.set_prio[1] = sp->pfs_1500.set_prio[1];
850 if (rt)
851 bcopy(&sp->pfs_1500.rt_addr, &st->act.rt_addr,
852 sizeof(st->act.rt_addr));
853 if (sp->pfs_1500.tagname[0] != 0)
854 st->tag = pf_tagname2tag(sp->pfs_1500.tagname);
855 break;
856 default:
857 panic("%s: Unsupported pfsync_msg_version %d",
858 __func__, msg_version);
859 }
860
861 st->expire = pf_get_uptime();
862 if (sp->pfs_1301.expire) {
863 uint32_t timeout;
864 timeout = r->timeout[st->timeout];
865 if (!timeout)
866 timeout = V_pf_default_rule.timeout[st->timeout];
867
868 /* sp->expire may have been adaptively scaled by export. */
869 st->expire -= (timeout - ntohl(sp->pfs_1301.expire)) * 1000;
870 }
871
872 if (! (st->act.rtableid == -1 ||
873 (st->act.rtableid >= 0 && st->act.rtableid < rt_numfibs)))
874 goto cleanup;
875
876 if (sks->proto == IPPROTO_SCTP && st->src.scrub == NULL) {
877 if (V_pf_status.debug >= PF_DEBUG_MISC)
878 printf("%s: invalid SCTP state from creator id: %08x\n", __func__,
879 ntohl(sp->pfs_1301.creatorid));
880 goto cleanup;
881 }
882
883 st->id = sp->pfs_1301.id;
884 st->creatorid = sp->pfs_1301.creatorid;
885 pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src);
886 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst);
887
888 st->rule = r;
889 st->nat_rule = NULL;
890 st->anchor = NULL;
891
892 st->pfsync_time = time_uptime;
893 st->sync_state = PFSYNC_S_NONE;
894
895 if (!(flags & PFSYNC_SI_IOCTL))
896 st->state_flags |= PFSTATE_NOSYNC;
897
898 if ((error = pf_state_insert(kif, orig_kif, skw, sks, st)) != 0)
899 goto cleanup_state;
900
901 /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
902 counter_u64_add(r->states_cur, 1);
903 counter_u64_add(r->states_tot, 1);
904
905 if (!(flags & PFSYNC_SI_IOCTL)) {
906 st->state_flags &= ~PFSTATE_NOSYNC;
907 if (st->state_flags & PFSTATE_ACK) {
908 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
909 PFSYNC_BUCKET_LOCK(b);
910 pfsync_q_ins(st, PFSYNC_S_IACK, true);
911 PFSYNC_BUCKET_UNLOCK(b);
912
913 pfsync_push_all(sc);
914 }
915 }
916 st->state_flags &= ~PFSTATE_ACK;
917 PF_STATE_UNLOCK(st);
918
919 return (0);
920
921 cleanup:
922 error = ENOMEM;
923
924 if (skw == sks)
925 sks = NULL;
926 uma_zfree(V_pf_state_key_z, skw);
927 uma_zfree(V_pf_state_key_z, sks);
928
929 cleanup_state: /* pf_state_insert() frees the state keys. */
930 if (st) {
931 st->timeout = PFTM_UNLINKED; /* appease an assert */
932 pf_free_state(st);
933 }
934 return (error);
935 }
936
937 #ifdef INET
938 static int
pfsync_input(struct mbuf ** mp,int * offp __unused,int proto __unused)939 pfsync_input(struct mbuf **mp, int *offp __unused, int proto __unused)
940 {
941 struct pfsync_softc *sc = V_pfsyncif;
942 struct mbuf *m = *mp;
943 struct ip *ip = mtod(m, struct ip *);
944 struct pfsync_header *ph;
945 struct pfsync_subheader subh;
946
947 int offset, len, flags = 0;
948 int rv;
949 uint16_t count;
950
951 PF_RULES_RLOCK_TRACKER;
952
953 *mp = NULL;
954 V_pfsyncstats.pfsyncs_ipackets++;
955
956 /* Verify that we have a sync interface configured. */
957 if (!sc || !sc->sc_sync_if || !V_pf_status.running ||
958 (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
959 goto done;
960
961 /* verify that the packet came in on the right interface */
962 if (sc->sc_sync_if != m->m_pkthdr.rcvif) {
963 V_pfsyncstats.pfsyncs_badif++;
964 goto done;
965 }
966
967 if_inc_counter(sc->sc_ifp, IFCOUNTER_IPACKETS, 1);
968 if_inc_counter(sc->sc_ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
969 /* verify that the IP TTL is 255. */
970 if (ip->ip_ttl != PFSYNC_DFLTTL) {
971 V_pfsyncstats.pfsyncs_badttl++;
972 goto done;
973 }
974
975 offset = ip->ip_hl << 2;
976 if (m->m_pkthdr.len < offset + sizeof(*ph)) {
977 V_pfsyncstats.pfsyncs_hdrops++;
978 goto done;
979 }
980
981 if (offset + sizeof(*ph) > m->m_len) {
982 if (m_pullup(m, offset + sizeof(*ph)) == NULL) {
983 V_pfsyncstats.pfsyncs_hdrops++;
984 return (IPPROTO_DONE);
985 }
986 ip = mtod(m, struct ip *);
987 }
988 ph = (struct pfsync_header *)((char *)ip + offset);
989
990 /* verify the version */
991 if (ph->version != PFSYNC_VERSION) {
992 V_pfsyncstats.pfsyncs_badver++;
993 goto done;
994 }
995
996 len = ntohs(ph->len) + offset;
997 if (m->m_pkthdr.len < len) {
998 V_pfsyncstats.pfsyncs_badlen++;
999 goto done;
1000 }
1001
1002 /*
1003 * Trusting pf_chksum during packet processing, as well as seeking
1004 * in interface name tree, require holding PF_RULES_RLOCK().
1005 */
1006 PF_RULES_RLOCK();
1007 if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
1008 flags = PFSYNC_SI_CKSUM;
1009
1010 offset += sizeof(*ph);
1011 while (offset <= len - sizeof(subh)) {
1012 m_copydata(m, offset, sizeof(subh), (caddr_t)&subh);
1013 offset += sizeof(subh);
1014
1015 if (subh.action >= PFSYNC_ACT_MAX) {
1016 V_pfsyncstats.pfsyncs_badact++;
1017 PF_RULES_RUNLOCK();
1018 goto done;
1019 }
1020
1021 count = ntohs(subh.count);
1022 V_pfsyncstats.pfsyncs_iacts[subh.action] += count;
1023 rv = (*pfsync_acts[subh.action])(m, offset, count, flags, subh.action);
1024 if (rv == -1) {
1025 PF_RULES_RUNLOCK();
1026 return (IPPROTO_DONE);
1027 }
1028
1029 offset += rv;
1030 }
1031 PF_RULES_RUNLOCK();
1032
1033 done:
1034 m_freem(m);
1035 return (IPPROTO_DONE);
1036 }
1037 #endif
1038
1039 #ifdef INET6
1040 static int
pfsync6_input(struct mbuf ** mp,int * offp __unused,int proto __unused)1041 pfsync6_input(struct mbuf **mp, int *offp __unused, int proto __unused)
1042 {
1043 struct pfsync_softc *sc = V_pfsyncif;
1044 struct mbuf *m = *mp;
1045 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
1046 struct pfsync_header *ph;
1047 struct pfsync_subheader subh;
1048
1049 int offset, len, flags = 0;
1050 int rv;
1051 uint16_t count;
1052
1053 PF_RULES_RLOCK_TRACKER;
1054
1055 *mp = NULL;
1056 V_pfsyncstats.pfsyncs_ipackets++;
1057
1058 /* Verify that we have a sync interface configured. */
1059 if (!sc || !sc->sc_sync_if || !V_pf_status.running ||
1060 (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1061 goto done;
1062
1063 /* verify that the packet came in on the right interface */
1064 if (sc->sc_sync_if != m->m_pkthdr.rcvif) {
1065 V_pfsyncstats.pfsyncs_badif++;
1066 goto done;
1067 }
1068
1069 if_inc_counter(sc->sc_ifp, IFCOUNTER_IPACKETS, 1);
1070 if_inc_counter(sc->sc_ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
1071 /* verify that the IP TTL is 255. */
1072 if (ip6->ip6_hlim != PFSYNC_DFLTTL) {
1073 V_pfsyncstats.pfsyncs_badttl++;
1074 goto done;
1075 }
1076
1077
1078 offset = sizeof(*ip6);
1079 if (m->m_pkthdr.len < offset + sizeof(*ph)) {
1080 V_pfsyncstats.pfsyncs_hdrops++;
1081 goto done;
1082 }
1083
1084 if (offset + sizeof(*ph) > m->m_len) {
1085 if (m_pullup(m, offset + sizeof(*ph)) == NULL) {
1086 V_pfsyncstats.pfsyncs_hdrops++;
1087 return (IPPROTO_DONE);
1088 }
1089 ip6 = mtod(m, struct ip6_hdr *);
1090 }
1091 ph = (struct pfsync_header *)((char *)ip6 + offset);
1092
1093 /* verify the version */
1094 if (ph->version != PFSYNC_VERSION) {
1095 V_pfsyncstats.pfsyncs_badver++;
1096 goto done;
1097 }
1098
1099 len = ntohs(ph->len) + offset;
1100 if (m->m_pkthdr.len < len) {
1101 V_pfsyncstats.pfsyncs_badlen++;
1102 goto done;
1103 }
1104
1105 /*
1106 * Trusting pf_chksum during packet processing, as well as seeking
1107 * in interface name tree, require holding PF_RULES_RLOCK().
1108 */
1109 PF_RULES_RLOCK();
1110 if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
1111 flags = PFSYNC_SI_CKSUM;
1112
1113 offset += sizeof(*ph);
1114 while (offset <= len - sizeof(subh)) {
1115 m_copydata(m, offset, sizeof(subh), (caddr_t)&subh);
1116 offset += sizeof(subh);
1117
1118 if (subh.action >= PFSYNC_ACT_MAX) {
1119 V_pfsyncstats.pfsyncs_badact++;
1120 PF_RULES_RUNLOCK();
1121 goto done;
1122 }
1123
1124 count = ntohs(subh.count);
1125 V_pfsyncstats.pfsyncs_iacts[subh.action] += count;
1126 rv = (*pfsync_acts[subh.action])(m, offset, count, flags, subh.action);
1127 if (rv == -1) {
1128 PF_RULES_RUNLOCK();
1129 return (IPPROTO_DONE);
1130 }
1131
1132 offset += rv;
1133 }
1134 PF_RULES_RUNLOCK();
1135
1136 done:
1137 m_freem(m);
1138 return (IPPROTO_DONE);
1139 }
1140 #endif
1141
1142 static int
pfsync_in_clr(struct mbuf * m,int offset,int count,int flags,int action)1143 pfsync_in_clr(struct mbuf *m, int offset, int count, int flags, int action)
1144 {
1145 struct pfsync_clr *clr;
1146 struct mbuf *mp;
1147 int len = sizeof(*clr) * count;
1148 int i, offp;
1149 u_int32_t creatorid;
1150
1151 mp = m_pulldown(m, offset, len, &offp);
1152 if (mp == NULL) {
1153 V_pfsyncstats.pfsyncs_badlen++;
1154 return (-1);
1155 }
1156 clr = (struct pfsync_clr *)(mp->m_data + offp);
1157
1158 for (i = 0; i < count; i++) {
1159 creatorid = clr[i].creatorid;
1160
1161 if (clr[i].ifname[0] != '\0' &&
1162 pfi_kkif_find(clr[i].ifname) == NULL)
1163 continue;
1164
1165 for (int i = 0; i <= V_pf_hashmask; i++) {
1166 struct pf_idhash *ih = &V_pf_idhash[i];
1167 struct pf_kstate *s;
1168 relock:
1169 PF_HASHROW_LOCK(ih);
1170 LIST_FOREACH(s, &ih->states, entry) {
1171 if (s->creatorid == creatorid) {
1172 s->state_flags |= PFSTATE_NOSYNC;
1173 pf_remove_state(s);
1174 goto relock;
1175 }
1176 }
1177 PF_HASHROW_UNLOCK(ih);
1178 }
1179 }
1180
1181 return (len);
1182 }
1183
1184 static int
pfsync_in_ins(struct mbuf * m,int offset,int count,int flags,int action)1185 pfsync_in_ins(struct mbuf *m, int offset, int count, int flags, int action)
1186 {
1187 struct mbuf *mp;
1188 union pfsync_state_union *sa, *sp;
1189 int i, offp, total_len, msg_version, msg_len;
1190 u_int8_t timeout, direction;
1191 sa_family_t af;
1192
1193 switch (action) {
1194 case PFSYNC_ACT_INS_1301:
1195 msg_len = sizeof(struct pfsync_state_1301);
1196 msg_version = PFSYNC_MSG_VERSION_1301;
1197 break;
1198 case PFSYNC_ACT_INS_1400:
1199 msg_len = sizeof(struct pfsync_state_1400);
1200 msg_version = PFSYNC_MSG_VERSION_1400;
1201 break;
1202 case PFSYNC_ACT_INS_1500:
1203 msg_len = sizeof(struct pfsync_state_1500);
1204 msg_version = PFSYNC_MSG_VERSION_1500;
1205 break;
1206 default:
1207 V_pfsyncstats.pfsyncs_badver++;
1208 return (-1);
1209 }
1210
1211 total_len = msg_len * count;
1212
1213 mp = m_pulldown(m, offset, total_len, &offp);
1214 if (mp == NULL) {
1215 V_pfsyncstats.pfsyncs_badlen++;
1216 return (-1);
1217 }
1218 sa = (union pfsync_state_union *)(mp->m_data + offp);
1219
1220 for (i = 0; i < count; i++) {
1221 sp = (union pfsync_state_union *)((char *)sa + msg_len * i);
1222
1223 switch (msg_version) {
1224 case PFSYNC_MSG_VERSION_1301:
1225 case PFSYNC_MSG_VERSION_1400:
1226 af = sp->pfs_1301.af;
1227 timeout = sp->pfs_1301.timeout;
1228 direction = sp->pfs_1301.direction;
1229 break;
1230 case PFSYNC_MSG_VERSION_1500:
1231 af = sp->pfs_1500.wire_af;
1232 timeout = sp->pfs_1500.timeout;
1233 direction = sp->pfs_1500.direction;
1234 break;
1235 }
1236
1237 /* Check for invalid values. */
1238 if (timeout >= PFTM_MAX ||
1239 sp->pfs_1301.src.state > PF_TCPS_PROXY_DST ||
1240 sp->pfs_1301.dst.state > PF_TCPS_PROXY_DST ||
1241 direction > PF_OUT ||
1242 (af != AF_INET && af != AF_INET6)) {
1243 if (V_pf_status.debug >= PF_DEBUG_MISC)
1244 printf("%s: invalid value\n", __func__);
1245 V_pfsyncstats.pfsyncs_badval++;
1246 continue;
1247 }
1248
1249 if (pfsync_state_import(sp, flags, msg_version) != 0)
1250 V_pfsyncstats.pfsyncs_badact++;
1251 }
1252
1253 return (total_len);
1254 }
1255
1256 static int
pfsync_in_iack(struct mbuf * m,int offset,int count,int flags,int action)1257 pfsync_in_iack(struct mbuf *m, int offset, int count, int flags, int action)
1258 {
1259 struct pfsync_ins_ack *ia, *iaa;
1260 struct pf_kstate *st;
1261
1262 struct mbuf *mp;
1263 int len = count * sizeof(*ia);
1264 int offp, i;
1265
1266 mp = m_pulldown(m, offset, len, &offp);
1267 if (mp == NULL) {
1268 V_pfsyncstats.pfsyncs_badlen++;
1269 return (-1);
1270 }
1271 iaa = (struct pfsync_ins_ack *)(mp->m_data + offp);
1272
1273 for (i = 0; i < count; i++) {
1274 ia = &iaa[i];
1275
1276 st = pf_find_state_byid(ia->id, ia->creatorid);
1277 if (st == NULL)
1278 continue;
1279
1280 if (st->state_flags & PFSTATE_ACK) {
1281 pfsync_undefer_state(st, 0);
1282 }
1283 PF_STATE_UNLOCK(st);
1284 }
1285 /*
1286 * XXX this is not yet implemented, but we know the size of the
1287 * message so we can skip it.
1288 */
1289
1290 return (count * sizeof(struct pfsync_ins_ack));
1291 }
1292
1293 static int
pfsync_upd_tcp(struct pf_kstate * st,struct pf_state_peer_export * src,struct pf_state_peer_export * dst)1294 pfsync_upd_tcp(struct pf_kstate *st, struct pf_state_peer_export *src,
1295 struct pf_state_peer_export *dst)
1296 {
1297 int sync = 0;
1298
1299 PF_STATE_LOCK_ASSERT(st);
1300
1301 /*
1302 * The state should never go backwards except
1303 * for syn-proxy states. Neither should the
1304 * sequence window slide backwards.
1305 */
1306 if ((st->src.state > src->state &&
1307 (st->src.state < PF_TCPS_PROXY_SRC ||
1308 src->state >= PF_TCPS_PROXY_SRC)) ||
1309
1310 (st->src.state == src->state &&
1311 SEQ_GT(st->src.seqlo, ntohl(src->seqlo))))
1312 sync++;
1313 else
1314 pf_state_peer_ntoh(src, &st->src);
1315
1316 if ((st->dst.state > dst->state) ||
1317
1318 (st->dst.state >= TCPS_SYN_SENT &&
1319 SEQ_GT(st->dst.seqlo, ntohl(dst->seqlo))))
1320 sync++;
1321 else
1322 pf_state_peer_ntoh(dst, &st->dst);
1323
1324 return (sync);
1325 }
1326
1327 static int
pfsync_in_upd(struct mbuf * m,int offset,int count,int flags,int action)1328 pfsync_in_upd(struct mbuf *m, int offset, int count, int flags, int action)
1329 {
1330 struct pfsync_softc *sc = V_pfsyncif;
1331 union pfsync_state_union *sa, *sp;
1332 struct pf_kstate *st;
1333 struct mbuf *mp;
1334 int sync, offp, i, total_len, msg_len, msg_version;
1335 u_int8_t timeout;
1336
1337 switch (action) {
1338 case PFSYNC_ACT_UPD_1301:
1339 msg_len = sizeof(struct pfsync_state_1301);
1340 msg_version = PFSYNC_MSG_VERSION_1301;
1341 break;
1342 case PFSYNC_ACT_UPD_1400:
1343 msg_len = sizeof(struct pfsync_state_1400);
1344 msg_version = PFSYNC_MSG_VERSION_1400;
1345 break;
1346 case PFSYNC_ACT_UPD_1500:
1347 msg_len = sizeof(struct pfsync_state_1500);
1348 msg_version = PFSYNC_MSG_VERSION_1500;
1349 break;
1350 default:
1351 V_pfsyncstats.pfsyncs_badact++;
1352 return (-1);
1353 }
1354
1355 total_len = msg_len * count;
1356
1357 mp = m_pulldown(m, offset, total_len, &offp);
1358 if (mp == NULL) {
1359 V_pfsyncstats.pfsyncs_badlen++;
1360 return (-1);
1361 }
1362 sa = (union pfsync_state_union *)(mp->m_data + offp);
1363
1364 for (i = 0; i < count; i++) {
1365 sp = (union pfsync_state_union *)((char *)sa + msg_len * i);
1366
1367 switch (msg_version) {
1368 case PFSYNC_MSG_VERSION_1301:
1369 case PFSYNC_MSG_VERSION_1400:
1370 timeout = sp->pfs_1301.timeout;
1371 break;
1372 case PFSYNC_MSG_VERSION_1500:
1373 timeout = sp->pfs_1500.timeout;
1374 break;
1375 }
1376
1377 /* check for invalid values */
1378 if (timeout >= PFTM_MAX ||
1379 sp->pfs_1301.src.state > PF_TCPS_PROXY_DST ||
1380 sp->pfs_1301.dst.state > PF_TCPS_PROXY_DST) {
1381 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1382 printf("pfsync_input: PFSYNC_ACT_UPD: "
1383 "invalid value\n");
1384 }
1385 V_pfsyncstats.pfsyncs_badval++;
1386 continue;
1387 }
1388
1389 st = pf_find_state_byid(sp->pfs_1301.id, sp->pfs_1301.creatorid);
1390 if (st == NULL) {
1391 /* insert the update */
1392 if (pfsync_state_import(sp, flags, msg_version))
1393 V_pfsyncstats.pfsyncs_badstate++;
1394 continue;
1395 }
1396
1397 if (st->state_flags & PFSTATE_ACK) {
1398 pfsync_undefer_state(st, 1);
1399 }
1400
1401 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP)
1402 sync = pfsync_upd_tcp(st, &sp->pfs_1301.src, &sp->pfs_1301.dst);
1403 else {
1404 sync = 0;
1405
1406 /*
1407 * Non-TCP protocol state machine always go
1408 * forwards
1409 */
1410 if (st->src.state > sp->pfs_1301.src.state)
1411 sync++;
1412 else
1413 pf_state_peer_ntoh(&sp->pfs_1301.src, &st->src);
1414 if (st->dst.state > sp->pfs_1301.dst.state)
1415 sync++;
1416 else
1417 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst);
1418 }
1419 if (sync < 2) {
1420 pfsync_alloc_scrub_memory(&sp->pfs_1301.dst, &st->dst);
1421 pf_state_peer_ntoh(&sp->pfs_1301.dst, &st->dst);
1422 st->expire = pf_get_uptime();
1423 st->timeout = timeout;
1424 }
1425 st->pfsync_time = time_uptime;
1426
1427 if (sync) {
1428 V_pfsyncstats.pfsyncs_stale++;
1429
1430 pfsync_update_state(st);
1431 PF_STATE_UNLOCK(st);
1432 pfsync_push_all(sc);
1433 continue;
1434 }
1435 PF_STATE_UNLOCK(st);
1436 }
1437
1438 return (total_len);
1439 }
1440
1441 static int
pfsync_in_upd_c(struct mbuf * m,int offset,int count,int flags,int action)1442 pfsync_in_upd_c(struct mbuf *m, int offset, int count, int flags, int action)
1443 {
1444 struct pfsync_softc *sc = V_pfsyncif;
1445 struct pfsync_upd_c *ua, *up;
1446 struct pf_kstate *st;
1447 int len = count * sizeof(*up);
1448 int sync;
1449 struct mbuf *mp;
1450 int offp, i;
1451
1452 mp = m_pulldown(m, offset, len, &offp);
1453 if (mp == NULL) {
1454 V_pfsyncstats.pfsyncs_badlen++;
1455 return (-1);
1456 }
1457 ua = (struct pfsync_upd_c *)(mp->m_data + offp);
1458
1459 for (i = 0; i < count; i++) {
1460 up = &ua[i];
1461
1462 /* check for invalid values */
1463 if (up->timeout >= PFTM_MAX ||
1464 up->src.state > PF_TCPS_PROXY_DST ||
1465 up->dst.state > PF_TCPS_PROXY_DST) {
1466 if (V_pf_status.debug >= PF_DEBUG_MISC) {
1467 printf("pfsync_input: "
1468 "PFSYNC_ACT_UPD_C: "
1469 "invalid value\n");
1470 }
1471 V_pfsyncstats.pfsyncs_badval++;
1472 continue;
1473 }
1474
1475 st = pf_find_state_byid(up->id, up->creatorid);
1476 if (st == NULL) {
1477 /* We don't have this state. Ask for it. */
1478 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]);
1479 pfsync_request_update(up->creatorid, up->id);
1480 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]);
1481 continue;
1482 }
1483
1484 if (st->state_flags & PFSTATE_ACK) {
1485 pfsync_undefer_state(st, 1);
1486 }
1487
1488 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP)
1489 sync = pfsync_upd_tcp(st, &up->src, &up->dst);
1490 else {
1491 sync = 0;
1492
1493 /*
1494 * Non-TCP protocol state machine always go
1495 * forwards
1496 */
1497 if (st->src.state > up->src.state)
1498 sync++;
1499 else
1500 pf_state_peer_ntoh(&up->src, &st->src);
1501 if (st->dst.state > up->dst.state)
1502 sync++;
1503 else
1504 pf_state_peer_ntoh(&up->dst, &st->dst);
1505 }
1506 if (sync < 2) {
1507 pfsync_alloc_scrub_memory(&up->dst, &st->dst);
1508 pf_state_peer_ntoh(&up->dst, &st->dst);
1509 st->expire = pf_get_uptime();
1510 st->timeout = up->timeout;
1511 }
1512 st->pfsync_time = time_uptime;
1513
1514 if (sync) {
1515 V_pfsyncstats.pfsyncs_stale++;
1516
1517 pfsync_update_state(st);
1518 PF_STATE_UNLOCK(st);
1519 pfsync_push_all(sc);
1520 continue;
1521 }
1522 PF_STATE_UNLOCK(st);
1523 }
1524
1525 return (len);
1526 }
1527
1528 static int
pfsync_in_ureq(struct mbuf * m,int offset,int count,int flags,int action)1529 pfsync_in_ureq(struct mbuf *m, int offset, int count, int flags, int action)
1530 {
1531 struct pfsync_upd_req *ur, *ura;
1532 struct mbuf *mp;
1533 int len = count * sizeof(*ur);
1534 int i, offp;
1535
1536 struct pf_kstate *st;
1537
1538 mp = m_pulldown(m, offset, len, &offp);
1539 if (mp == NULL) {
1540 V_pfsyncstats.pfsyncs_badlen++;
1541 return (-1);
1542 }
1543 ura = (struct pfsync_upd_req *)(mp->m_data + offp);
1544
1545 for (i = 0; i < count; i++) {
1546 ur = &ura[i];
1547
1548 if (ur->id == 0 && ur->creatorid == 0)
1549 pfsync_bulk_start();
1550 else {
1551 st = pf_find_state_byid(ur->id, ur->creatorid);
1552 if (st == NULL) {
1553 V_pfsyncstats.pfsyncs_badstate++;
1554 continue;
1555 }
1556 if (st->state_flags & PFSTATE_NOSYNC) {
1557 PF_STATE_UNLOCK(st);
1558 continue;
1559 }
1560
1561 pfsync_update_state_req(st);
1562 PF_STATE_UNLOCK(st);
1563 }
1564 }
1565
1566 return (len);
1567 }
1568
1569 static int
pfsync_in_del_c(struct mbuf * m,int offset,int count,int flags,int action)1570 pfsync_in_del_c(struct mbuf *m, int offset, int count, int flags, int action)
1571 {
1572 struct mbuf *mp;
1573 struct pfsync_del_c *sa, *sp;
1574 struct pf_kstate *st;
1575 int len = count * sizeof(*sp);
1576 int offp, i;
1577
1578 mp = m_pulldown(m, offset, len, &offp);
1579 if (mp == NULL) {
1580 V_pfsyncstats.pfsyncs_badlen++;
1581 return (-1);
1582 }
1583 sa = (struct pfsync_del_c *)(mp->m_data + offp);
1584
1585 for (i = 0; i < count; i++) {
1586 sp = &sa[i];
1587
1588 st = pf_find_state_byid(sp->id, sp->creatorid);
1589 if (st == NULL) {
1590 V_pfsyncstats.pfsyncs_badstate++;
1591 continue;
1592 }
1593
1594 st->state_flags |= PFSTATE_NOSYNC;
1595 pf_remove_state(st);
1596 }
1597
1598 return (len);
1599 }
1600
1601 static int
pfsync_in_bus(struct mbuf * m,int offset,int count,int flags,int action)1602 pfsync_in_bus(struct mbuf *m, int offset, int count, int flags, int action)
1603 {
1604 struct pfsync_softc *sc = V_pfsyncif;
1605 struct pfsync_bus *bus;
1606 struct mbuf *mp;
1607 int len = count * sizeof(*bus);
1608 int offp;
1609
1610 PFSYNC_BLOCK(sc);
1611
1612 /* If we're not waiting for a bulk update, who cares. */
1613 if (sc->sc_ureq_sent == 0) {
1614 PFSYNC_BUNLOCK(sc);
1615 return (len);
1616 }
1617
1618 mp = m_pulldown(m, offset, len, &offp);
1619 if (mp == NULL) {
1620 PFSYNC_BUNLOCK(sc);
1621 V_pfsyncstats.pfsyncs_badlen++;
1622 return (-1);
1623 }
1624 bus = (struct pfsync_bus *)(mp->m_data + offp);
1625
1626 switch (bus->status) {
1627 case PFSYNC_BUS_START:
1628 callout_reset(&sc->sc_bulkfail_tmo, 4 * hz +
1629 V_pf_limits[PF_LIMIT_STATES].limit /
1630 ((sc->sc_ifp->if_mtu - PFSYNC_MINPKT) /
1631 sizeof(union pfsync_state_union)),
1632 pfsync_bulk_fail, sc);
1633 if (V_pf_status.debug >= PF_DEBUG_MISC)
1634 printf("pfsync: received bulk update start\n");
1635 break;
1636
1637 case PFSYNC_BUS_END:
1638 if (time_uptime - ntohl(bus->endtime) >=
1639 sc->sc_ureq_sent) {
1640 /* that's it, we're happy */
1641 sc->sc_ureq_sent = 0;
1642 sc->sc_bulk_tries = 0;
1643 callout_stop(&sc->sc_bulkfail_tmo);
1644 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
1645 (*carp_demote_adj_p)(-V_pfsync_carp_adj,
1646 "pfsync bulk done");
1647 sc->sc_flags |= PFSYNCF_OK;
1648 if (V_pf_status.debug >= PF_DEBUG_MISC)
1649 printf("pfsync: received valid "
1650 "bulk update end\n");
1651 } else {
1652 if (V_pf_status.debug >= PF_DEBUG_MISC)
1653 printf("pfsync: received invalid "
1654 "bulk update end: bad timestamp\n");
1655 }
1656 break;
1657 }
1658 PFSYNC_BUNLOCK(sc);
1659
1660 return (len);
1661 }
1662
1663 static int
pfsync_in_tdb(struct mbuf * m,int offset,int count,int flags,int action)1664 pfsync_in_tdb(struct mbuf *m, int offset, int count, int flags, int action)
1665 {
1666 int len = count * sizeof(struct pfsync_tdb);
1667
1668 #if defined(IPSEC)
1669 struct pfsync_tdb *tp;
1670 struct mbuf *mp;
1671 int offp;
1672 int i;
1673 int s;
1674
1675 mp = m_pulldown(m, offset, len, &offp);
1676 if (mp == NULL) {
1677 V_pfsyncstats.pfsyncs_badlen++;
1678 return (-1);
1679 }
1680 tp = (struct pfsync_tdb *)(mp->m_data + offp);
1681
1682 for (i = 0; i < count; i++)
1683 pfsync_update_net_tdb(&tp[i]);
1684 #endif
1685
1686 return (len);
1687 }
1688
1689 #if defined(IPSEC)
1690 /* Update an in-kernel tdb. Silently fail if no tdb is found. */
1691 static void
pfsync_update_net_tdb(struct pfsync_tdb * pt)1692 pfsync_update_net_tdb(struct pfsync_tdb *pt)
1693 {
1694 struct tdb *tdb;
1695 int s;
1696
1697 /* check for invalid values */
1698 if (ntohl(pt->spi) <= SPI_RESERVED_MAX ||
1699 (pt->dst.sa.sa_family != AF_INET &&
1700 pt->dst.sa.sa_family != AF_INET6))
1701 goto bad;
1702
1703 tdb = gettdb(pt->spi, &pt->dst, pt->sproto);
1704 if (tdb) {
1705 pt->rpl = ntohl(pt->rpl);
1706 pt->cur_bytes = (unsigned long long)be64toh(pt->cur_bytes);
1707
1708 /* Neither replay nor byte counter should ever decrease. */
1709 if (pt->rpl < tdb->tdb_rpl ||
1710 pt->cur_bytes < tdb->tdb_cur_bytes) {
1711 goto bad;
1712 }
1713
1714 tdb->tdb_rpl = pt->rpl;
1715 tdb->tdb_cur_bytes = pt->cur_bytes;
1716 }
1717 return;
1718
1719 bad:
1720 if (V_pf_status.debug >= PF_DEBUG_MISC)
1721 printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: "
1722 "invalid value\n");
1723 V_pfsyncstats.pfsyncs_badstate++;
1724 return;
1725 }
1726 #endif
1727
1728 static int
pfsync_in_eof(struct mbuf * m,int offset,int count,int flags,int action)1729 pfsync_in_eof(struct mbuf *m, int offset, int count, int flags, int action)
1730 {
1731 /* check if we are at the right place in the packet */
1732 if (offset != m->m_pkthdr.len)
1733 V_pfsyncstats.pfsyncs_badlen++;
1734
1735 /* we're done. free and let the caller return */
1736 m_freem(m);
1737 return (-1);
1738 }
1739
1740 static int
pfsync_in_error(struct mbuf * m,int offset,int count,int flags,int action)1741 pfsync_in_error(struct mbuf *m, int offset, int count, int flags, int action)
1742 {
1743 V_pfsyncstats.pfsyncs_badact++;
1744
1745 m_freem(m);
1746 return (-1);
1747 }
1748
1749 static int
pfsyncoutput(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,struct route * rt)1750 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
1751 struct route *rt)
1752 {
1753 m_freem(m);
1754 return (0);
1755 }
1756
1757 /* ARGSUSED */
1758 static int
pfsyncioctl(struct ifnet * ifp,u_long cmd,caddr_t data)1759 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1760 {
1761 struct pfsync_softc *sc = ifp->if_softc;
1762 struct ifreq *ifr = (struct ifreq *)data;
1763 struct pfsyncreq pfsyncr;
1764 size_t nvbuflen;
1765 int error;
1766 int c;
1767
1768 switch (cmd) {
1769 case SIOCSIFFLAGS:
1770 PFSYNC_LOCK(sc);
1771 if (ifp->if_flags & IFF_UP) {
1772 ifp->if_drv_flags |= IFF_DRV_RUNNING;
1773 PFSYNC_UNLOCK(sc);
1774 pfsync_pointers_init();
1775 } else {
1776 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1777 PFSYNC_UNLOCK(sc);
1778 pfsync_pointers_uninit();
1779 }
1780 break;
1781 case SIOCSIFMTU:
1782 if (!sc->sc_sync_if ||
1783 ifr->ifr_mtu <= PFSYNC_MINPKT ||
1784 ifr->ifr_mtu > sc->sc_sync_if->if_mtu)
1785 return (EINVAL);
1786 if (ifr->ifr_mtu < ifp->if_mtu) {
1787 for (c = 0; c < pfsync_buckets; c++) {
1788 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]);
1789 if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT)
1790 pfsync_sendout(1, c);
1791 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]);
1792 }
1793 }
1794 ifp->if_mtu = ifr->ifr_mtu;
1795 break;
1796 case SIOCGETPFSYNC:
1797 bzero(&pfsyncr, sizeof(pfsyncr));
1798 PFSYNC_LOCK(sc);
1799 if (sc->sc_sync_if) {
1800 strlcpy(pfsyncr.pfsyncr_syncdev,
1801 sc->sc_sync_if->if_xname, IFNAMSIZ);
1802 }
1803 pfsyncr.pfsyncr_syncpeer = ((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr;
1804 pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
1805 pfsyncr.pfsyncr_defer = sc->sc_flags;
1806 PFSYNC_UNLOCK(sc);
1807 return (copyout(&pfsyncr, ifr_data_get_ptr(ifr),
1808 sizeof(pfsyncr)));
1809
1810 case SIOCGETPFSYNCNV:
1811 {
1812 nvlist_t *nvl_syncpeer;
1813 nvlist_t *nvl = nvlist_create(0);
1814
1815 if (nvl == NULL)
1816 return (ENOMEM);
1817
1818 if (sc->sc_sync_if)
1819 nvlist_add_string(nvl, "syncdev", sc->sc_sync_if->if_xname);
1820 nvlist_add_number(nvl, "maxupdates", sc->sc_maxupdates);
1821 nvlist_add_number(nvl, "flags", sc->sc_flags);
1822 nvlist_add_number(nvl, "version", sc->sc_version);
1823 if ((nvl_syncpeer = pfsync_sockaddr_to_syncpeer_nvlist(&sc->sc_sync_peer)) != NULL)
1824 nvlist_add_nvlist(nvl, "syncpeer", nvl_syncpeer);
1825
1826 void *packed = NULL;
1827 packed = nvlist_pack(nvl, &nvbuflen);
1828 if (packed == NULL) {
1829 free(packed, M_NVLIST);
1830 nvlist_destroy(nvl);
1831 return (ENOMEM);
1832 }
1833
1834 if (nvbuflen > ifr->ifr_cap_nv.buf_length) {
1835 ifr->ifr_cap_nv.length = nvbuflen;
1836 ifr->ifr_cap_nv.buffer = NULL;
1837 free(packed, M_NVLIST);
1838 nvlist_destroy(nvl);
1839 return (EFBIG);
1840 }
1841
1842 ifr->ifr_cap_nv.length = nvbuflen;
1843 error = copyout(packed, ifr->ifr_cap_nv.buffer, nvbuflen);
1844
1845 nvlist_destroy(nvl);
1846 nvlist_destroy(nvl_syncpeer);
1847 free(packed, M_NVLIST);
1848 break;
1849 }
1850
1851 case SIOCSETPFSYNC:
1852 {
1853 struct pfsync_kstatus status;
1854
1855 if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
1856 return (error);
1857 if ((error = copyin(ifr_data_get_ptr(ifr), &pfsyncr,
1858 sizeof(pfsyncr))))
1859 return (error);
1860
1861 memset((char *)&status, 0, sizeof(struct pfsync_kstatus));
1862 pfsync_pfsyncreq_to_kstatus(&pfsyncr, &status);
1863
1864 error = pfsync_kstatus_to_softc(&status, sc);
1865 return (error);
1866 }
1867 case SIOCSETPFSYNCNV:
1868 {
1869 struct pfsync_kstatus status;
1870 void *data;
1871 nvlist_t *nvl;
1872
1873 if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
1874 return (error);
1875 if (ifr->ifr_cap_nv.length > IFR_CAP_NV_MAXBUFSIZE)
1876 return (EINVAL);
1877
1878 data = malloc(ifr->ifr_cap_nv.length, M_PF, M_WAITOK);
1879
1880 if ((error = copyin(ifr->ifr_cap_nv.buffer, data,
1881 ifr->ifr_cap_nv.length)) != 0) {
1882 free(data, M_PF);
1883 return (error);
1884 }
1885
1886 if ((nvl = nvlist_unpack(data, ifr->ifr_cap_nv.length, 0)) == NULL) {
1887 free(data, M_PF);
1888 return (EINVAL);
1889 }
1890
1891 memset((char *)&status, 0, sizeof(struct pfsync_kstatus));
1892 pfsync_nvstatus_to_kstatus(nvl, &status);
1893
1894 nvlist_destroy(nvl);
1895 free(data, M_PF);
1896
1897 error = pfsync_kstatus_to_softc(&status, sc);
1898 return (error);
1899 }
1900 default:
1901 return (ENOTTY);
1902 }
1903
1904 return (0);
1905 }
1906
1907 static void
pfsync_out_state_1301(struct pf_kstate * st,void * buf)1908 pfsync_out_state_1301(struct pf_kstate *st, void *buf)
1909 {
1910 struct pfsync_state_1301 *sp;
1911
1912 sp = buf;
1913 pfsync_state_export_1301(sp, st);
1914 }
1915
1916 static void
pfsync_out_state_1400(struct pf_kstate * st,void * buf)1917 pfsync_out_state_1400(struct pf_kstate *st, void *buf)
1918 {
1919 struct pfsync_state_1400 *sp;
1920
1921 sp = buf;
1922 pfsync_state_export_1400(sp, st);
1923 }
1924
1925 static void
pfsync_out_state_1500(struct pf_kstate * st,void * buf)1926 pfsync_out_state_1500(struct pf_kstate *st, void *buf)
1927 {
1928 struct pfsync_state_1500 *sp;
1929
1930 sp = buf;
1931 pfsync_state_export_1500(sp, st);
1932 }
1933
1934 static void
pfsync_out_iack(struct pf_kstate * st,void * buf)1935 pfsync_out_iack(struct pf_kstate *st, void *buf)
1936 {
1937 struct pfsync_ins_ack *iack = buf;
1938
1939 iack->id = st->id;
1940 iack->creatorid = st->creatorid;
1941 }
1942
1943 static void
pfsync_out_upd_c(struct pf_kstate * st,void * buf)1944 pfsync_out_upd_c(struct pf_kstate *st, void *buf)
1945 {
1946 struct pfsync_upd_c *up = buf;
1947
1948 bzero(up, sizeof(*up));
1949 up->id = st->id;
1950 pf_state_peer_hton(&st->src, &up->src);
1951 pf_state_peer_hton(&st->dst, &up->dst);
1952 up->creatorid = st->creatorid;
1953 up->timeout = st->timeout;
1954 }
1955
1956 static void
pfsync_out_del_c(struct pf_kstate * st,void * buf)1957 pfsync_out_del_c(struct pf_kstate *st, void *buf)
1958 {
1959 struct pfsync_del_c *dp = buf;
1960
1961 dp->id = st->id;
1962 dp->creatorid = st->creatorid;
1963 st->state_flags |= PFSTATE_NOSYNC;
1964 }
1965
1966 static void
pfsync_drop_all(struct pfsync_softc * sc)1967 pfsync_drop_all(struct pfsync_softc *sc)
1968 {
1969 struct pfsync_bucket *b;
1970 int c;
1971
1972 for (c = 0; c < pfsync_buckets; c++) {
1973 b = &sc->sc_buckets[c];
1974
1975 PFSYNC_BUCKET_LOCK(b);
1976 pfsync_drop(sc, c);
1977 PFSYNC_BUCKET_UNLOCK(b);
1978 }
1979 }
1980
1981 static void
pfsync_drop(struct pfsync_softc * sc,int c)1982 pfsync_drop(struct pfsync_softc *sc, int c)
1983 {
1984 struct pf_kstate *st, *next;
1985 struct pfsync_upd_req_item *ur;
1986 struct pfsync_bucket *b;
1987 enum pfsync_q_id q;
1988
1989 b = &sc->sc_buckets[c];
1990 PFSYNC_BUCKET_LOCK_ASSERT(b);
1991
1992 for (q = 0; q < PFSYNC_Q_COUNT; q++) {
1993 if (TAILQ_EMPTY(&b->b_qs[q]))
1994 continue;
1995
1996 TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, next) {
1997 KASSERT(st->sync_state == pfsync_qid_sstate[q],
1998 ("%s: st->sync_state %d == q %d",
1999 __func__, st->sync_state, q));
2000 st->sync_state = PFSYNC_S_NONE;
2001 pf_release_state(st);
2002 }
2003 TAILQ_INIT(&b->b_qs[q]);
2004 }
2005
2006 while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) {
2007 TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry);
2008 free(ur, M_PFSYNC);
2009 }
2010
2011 b->b_len = PFSYNC_MINPKT;
2012 free(b->b_plus, M_PFSYNC);
2013 b->b_plus = NULL;
2014 b->b_pluslen = 0;
2015 }
2016
2017 static void
pfsync_sendout(int schedswi,int c)2018 pfsync_sendout(int schedswi, int c)
2019 {
2020 struct pfsync_softc *sc = V_pfsyncif;
2021 struct ifnet *ifp = sc->sc_ifp;
2022 struct mbuf *m;
2023 struct pfsync_header *ph;
2024 struct pfsync_subheader *subh;
2025 struct pf_kstate *st, *st_next;
2026 struct pfsync_upd_req_item *ur;
2027 struct pfsync_bucket *b = &sc->sc_buckets[c];
2028 size_t len;
2029 int aflen, offset, count = 0;
2030 enum pfsync_q_id q;
2031
2032 KASSERT(sc != NULL, ("%s: null sc", __func__));
2033 KASSERT(b->b_len > PFSYNC_MINPKT,
2034 ("%s: sc_len %zu", __func__, b->b_len));
2035 PFSYNC_BUCKET_LOCK_ASSERT(b);
2036
2037 if (!bpf_peers_present(ifp->if_bpf) && sc->sc_sync_if == NULL) {
2038 pfsync_drop(sc, c);
2039 return;
2040 }
2041
2042 m = m_get3(max_linkhdr + b->b_len, M_NOWAIT, MT_DATA, M_PKTHDR);
2043 if (m == NULL) {
2044 if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2045 V_pfsyncstats.pfsyncs_onomem++;
2046 return;
2047 }
2048 m->m_data += max_linkhdr;
2049 bzero(m->m_data, b->b_len);
2050
2051 len = b->b_len;
2052
2053 /* build the ip header */
2054 switch (sc->sc_sync_peer.ss_family) {
2055 #ifdef INET
2056 case AF_INET:
2057 {
2058 struct ip *ip;
2059
2060 ip = mtod(m, struct ip *);
2061 bcopy(&sc->sc_template.ipv4, ip, sizeof(*ip));
2062 aflen = offset = sizeof(*ip);
2063
2064 len -= sizeof(union inet_template) - sizeof(struct ip);
2065 ip->ip_len = htons(len);
2066 ip_fillid(ip, V_ip_random_id);
2067 break;
2068 }
2069 #endif
2070 #ifdef INET6
2071 case AF_INET6:
2072 {
2073 struct ip6_hdr *ip6;
2074
2075 ip6 = mtod(m, struct ip6_hdr *);
2076 bcopy(&sc->sc_template.ipv6, ip6, sizeof(*ip6));
2077 aflen = offset = sizeof(*ip6);
2078
2079 len -= sizeof(union inet_template) - sizeof(struct ip6_hdr);
2080 ip6->ip6_plen = htons(len);
2081 break;
2082 }
2083 #endif
2084 default:
2085 m_freem(m);
2086 pfsync_drop(sc, c);
2087 return;
2088 }
2089 m->m_len = m->m_pkthdr.len = len;
2090
2091 /* build the pfsync header */
2092 ph = (struct pfsync_header *)(m->m_data + offset);
2093 offset += sizeof(*ph);
2094
2095 ph->version = PFSYNC_VERSION;
2096 ph->len = htons(len - aflen);
2097 bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
2098
2099 /* walk the queues */
2100 for (q = 0; q < PFSYNC_Q_COUNT; q++) {
2101 if (TAILQ_EMPTY(&b->b_qs[q]))
2102 continue;
2103
2104 subh = (struct pfsync_subheader *)(m->m_data + offset);
2105 offset += sizeof(*subh);
2106
2107 count = 0;
2108 TAILQ_FOREACH_SAFE(st, &b->b_qs[q], sync_list, st_next) {
2109 KASSERT(st->sync_state == pfsync_qid_sstate[q],
2110 ("%s: st->sync_state == q",
2111 __func__));
2112 /*
2113 * XXXGL: some of write methods do unlocked reads
2114 * of state data :(
2115 */
2116 pfsync_qs[q].write(st, m->m_data + offset);
2117 offset += pfsync_qs[q].len;
2118 st->sync_state = PFSYNC_S_NONE;
2119 pf_release_state(st);
2120 count++;
2121 }
2122 TAILQ_INIT(&b->b_qs[q]);
2123
2124 subh->action = pfsync_qs[q].action;
2125 subh->count = htons(count);
2126 V_pfsyncstats.pfsyncs_oacts[pfsync_qs[q].action] += count;
2127 }
2128
2129 if (!TAILQ_EMPTY(&b->b_upd_req_list)) {
2130 subh = (struct pfsync_subheader *)(m->m_data + offset);
2131 offset += sizeof(*subh);
2132
2133 count = 0;
2134 while ((ur = TAILQ_FIRST(&b->b_upd_req_list)) != NULL) {
2135 TAILQ_REMOVE(&b->b_upd_req_list, ur, ur_entry);
2136
2137 bcopy(&ur->ur_msg, m->m_data + offset,
2138 sizeof(ur->ur_msg));
2139 offset += sizeof(ur->ur_msg);
2140 free(ur, M_PFSYNC);
2141 count++;
2142 }
2143
2144 subh->action = PFSYNC_ACT_UPD_REQ;
2145 subh->count = htons(count);
2146 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_UPD_REQ] += count;
2147 }
2148
2149 /* has someone built a custom region for us to add? */
2150 if (b->b_plus != NULL) {
2151 bcopy(b->b_plus, m->m_data + offset, b->b_pluslen);
2152 offset += b->b_pluslen;
2153
2154 free(b->b_plus, M_PFSYNC);
2155 b->b_plus = NULL;
2156 b->b_pluslen = 0;
2157 }
2158
2159 subh = (struct pfsync_subheader *)(m->m_data + offset);
2160 offset += sizeof(*subh);
2161
2162 subh->action = PFSYNC_ACT_EOF;
2163 subh->count = htons(1);
2164 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_EOF]++;
2165
2166 /* we're done, let's put it on the wire */
2167 if (bpf_peers_present(ifp->if_bpf)) {
2168 m->m_data += aflen;
2169 m->m_len = m->m_pkthdr.len = len - aflen;
2170 bpf_mtap(ifp->if_bpf, m);
2171 m->m_data -= aflen;
2172 m->m_len = m->m_pkthdr.len = len;
2173 }
2174
2175 if (sc->sc_sync_if == NULL) {
2176 b->b_len = PFSYNC_MINPKT;
2177 m_freem(m);
2178 return;
2179 }
2180
2181 if_inc_counter(sc->sc_ifp, IFCOUNTER_OPACKETS, 1);
2182 if_inc_counter(sc->sc_ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len);
2183 b->b_len = PFSYNC_MINPKT;
2184
2185 if (!_IF_QFULL(&b->b_snd))
2186 _IF_ENQUEUE(&b->b_snd, m);
2187 else {
2188 m_freem(m);
2189 if_inc_counter(sc->sc_ifp, IFCOUNTER_OQDROPS, 1);
2190 }
2191 if (schedswi)
2192 swi_sched(V_pfsync_swi_cookie, 0);
2193 }
2194
2195 static void
pfsync_insert_state(struct pf_kstate * st)2196 pfsync_insert_state(struct pf_kstate *st)
2197 {
2198 struct pfsync_softc *sc = V_pfsyncif;
2199 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2200
2201 if (st->state_flags & PFSTATE_NOSYNC)
2202 return;
2203
2204 if ((st->rule->rule_flag & PFRULE_NOSYNC) ||
2205 st->key[PF_SK_WIRE]->proto == IPPROTO_PFSYNC) {
2206 st->state_flags |= PFSTATE_NOSYNC;
2207 return;
2208 }
2209
2210 KASSERT(st->sync_state == PFSYNC_S_NONE,
2211 ("%s: st->sync_state %u", __func__, st->sync_state));
2212
2213 PFSYNC_BUCKET_LOCK(b);
2214 if (b->b_len == PFSYNC_MINPKT)
2215 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b);
2216
2217 pfsync_q_ins(st, PFSYNC_S_INS, true);
2218 PFSYNC_BUCKET_UNLOCK(b);
2219
2220 st->sync_updates = 0;
2221 }
2222
2223 static int
pfsync_defer(struct pf_kstate * st,struct mbuf * m)2224 pfsync_defer(struct pf_kstate *st, struct mbuf *m)
2225 {
2226 struct pfsync_softc *sc = V_pfsyncif;
2227 struct pfsync_deferral *pd;
2228 struct pfsync_bucket *b;
2229
2230 if (m->m_flags & (M_BCAST|M_MCAST))
2231 return (0);
2232
2233 if (sc == NULL)
2234 return (0);
2235
2236 b = pfsync_get_bucket(sc, st);
2237
2238 PFSYNC_LOCK(sc);
2239
2240 if (!(sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) ||
2241 !(sc->sc_flags & PFSYNCF_DEFER)) {
2242 PFSYNC_UNLOCK(sc);
2243 return (0);
2244 }
2245
2246 PFSYNC_BUCKET_LOCK(b);
2247 PFSYNC_UNLOCK(sc);
2248
2249 if (b->b_deferred >= 128)
2250 pfsync_undefer(TAILQ_FIRST(&b->b_deferrals), 0);
2251
2252 pd = malloc(sizeof(*pd), M_PFSYNC, M_NOWAIT);
2253 if (pd == NULL) {
2254 PFSYNC_BUCKET_UNLOCK(b);
2255 return (0);
2256 }
2257 b->b_deferred++;
2258
2259 m->m_flags |= M_SKIP_FIREWALL;
2260 st->state_flags |= PFSTATE_ACK;
2261
2262 pd->pd_sc = sc;
2263 pd->pd_st = st;
2264 pf_ref_state(st);
2265 pd->pd_m = m;
2266
2267 TAILQ_INSERT_TAIL(&b->b_deferrals, pd, pd_entry);
2268 callout_init_mtx(&pd->pd_tmo, &b->b_mtx, CALLOUT_RETURNUNLOCKED);
2269 callout_reset(&pd->pd_tmo, (V_pfsync_defer_timeout * hz) / 1000,
2270 pfsync_defer_tmo, pd);
2271
2272 pfsync_push(b);
2273 PFSYNC_BUCKET_UNLOCK(b);
2274
2275 return (1);
2276 }
2277
2278 static void
pfsync_undefer(struct pfsync_deferral * pd,int drop)2279 pfsync_undefer(struct pfsync_deferral *pd, int drop)
2280 {
2281 struct pfsync_softc *sc = pd->pd_sc;
2282 struct mbuf *m = pd->pd_m;
2283 struct pf_kstate *st = pd->pd_st;
2284 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2285
2286 PFSYNC_BUCKET_LOCK_ASSERT(b);
2287
2288 TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry);
2289 b->b_deferred--;
2290 pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */
2291 free(pd, M_PFSYNC);
2292 pf_release_state(st);
2293
2294 if (drop)
2295 m_freem(m);
2296 else {
2297 _IF_ENQUEUE(&b->b_snd, m);
2298 pfsync_push(b);
2299 }
2300 }
2301
2302 static void
pfsync_defer_tmo(void * arg)2303 pfsync_defer_tmo(void *arg)
2304 {
2305 struct epoch_tracker et;
2306 struct pfsync_deferral *pd = arg;
2307 struct pfsync_softc *sc = pd->pd_sc;
2308 struct mbuf *m = pd->pd_m;
2309 struct pf_kstate *st = pd->pd_st;
2310 struct pfsync_bucket *b;
2311
2312 CURVNET_SET(sc->sc_ifp->if_vnet);
2313
2314 b = pfsync_get_bucket(sc, st);
2315
2316 PFSYNC_BUCKET_LOCK_ASSERT(b);
2317
2318 TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry);
2319 b->b_deferred--;
2320 pd->pd_st->state_flags &= ~PFSTATE_ACK; /* XXX: locking! */
2321 PFSYNC_BUCKET_UNLOCK(b);
2322 free(pd, M_PFSYNC);
2323
2324 if (sc->sc_sync_if == NULL) {
2325 pf_release_state(st);
2326 m_freem(m);
2327 CURVNET_RESTORE();
2328 return;
2329 }
2330
2331 NET_EPOCH_ENTER(et);
2332
2333 pfsync_tx(sc, m);
2334
2335 pf_release_state(st);
2336
2337 CURVNET_RESTORE();
2338 NET_EPOCH_EXIT(et);
2339 }
2340
2341 static void
pfsync_undefer_state_locked(struct pf_kstate * st,int drop)2342 pfsync_undefer_state_locked(struct pf_kstate *st, int drop)
2343 {
2344 struct pfsync_softc *sc = V_pfsyncif;
2345 struct pfsync_deferral *pd;
2346 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2347
2348 PFSYNC_BUCKET_LOCK_ASSERT(b);
2349
2350 TAILQ_FOREACH(pd, &b->b_deferrals, pd_entry) {
2351 if (pd->pd_st == st) {
2352 if (callout_stop(&pd->pd_tmo) > 0)
2353 pfsync_undefer(pd, drop);
2354
2355 return;
2356 }
2357 }
2358
2359 /*
2360 * If we don't find this state in b_deferrals that might be because we
2361 * overflowed the list (see pfsync_defer()'s >= 128 check') or because
2362 * the deferral timed out already (see pfsync_defer_tomo()).
2363 */
2364 }
2365
2366 static void
pfsync_undefer_state(struct pf_kstate * st,int drop)2367 pfsync_undefer_state(struct pf_kstate *st, int drop)
2368 {
2369 struct pfsync_softc *sc = V_pfsyncif;
2370 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2371
2372 PFSYNC_BUCKET_LOCK(b);
2373 pfsync_undefer_state_locked(st, drop);
2374 PFSYNC_BUCKET_UNLOCK(b);
2375 }
2376
2377 static struct pfsync_bucket*
pfsync_get_bucket(struct pfsync_softc * sc,struct pf_kstate * st)2378 pfsync_get_bucket(struct pfsync_softc *sc, struct pf_kstate *st)
2379 {
2380 int c = PF_IDHASH(st) % pfsync_buckets;
2381 return &sc->sc_buckets[c];
2382 }
2383
2384 static void
pfsync_update_state(struct pf_kstate * st)2385 pfsync_update_state(struct pf_kstate *st)
2386 {
2387 struct pfsync_softc *sc = V_pfsyncif;
2388 bool sync = false, ref = true;
2389 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2390
2391 PF_STATE_LOCK_ASSERT(st);
2392 PFSYNC_BUCKET_LOCK(b);
2393
2394 if (st->state_flags & PFSTATE_ACK)
2395 pfsync_undefer_state_locked(st, 0);
2396 if (st->state_flags & PFSTATE_NOSYNC) {
2397 if (st->sync_state != PFSYNC_S_NONE)
2398 pfsync_q_del(st, true, b);
2399 PFSYNC_BUCKET_UNLOCK(b);
2400 return;
2401 }
2402
2403 if (b->b_len == PFSYNC_MINPKT)
2404 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b);
2405
2406 switch (st->sync_state) {
2407 case PFSYNC_S_UPD_C:
2408 case PFSYNC_S_UPD:
2409 case PFSYNC_S_INS:
2410 /* we're already handling it */
2411
2412 if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) {
2413 st->sync_updates++;
2414 if (st->sync_updates >= sc->sc_maxupdates)
2415 sync = true;
2416 }
2417 break;
2418
2419 case PFSYNC_S_IACK:
2420 pfsync_q_del(st, false, b);
2421 ref = false;
2422 /* FALLTHROUGH */
2423
2424 case PFSYNC_S_NONE:
2425 pfsync_q_ins(st, PFSYNC_S_UPD_C, ref);
2426 st->sync_updates = 0;
2427 break;
2428
2429 default:
2430 panic("%s: unexpected sync state %d", __func__, st->sync_state);
2431 }
2432
2433 if (sync || (time_uptime - st->pfsync_time) < 2)
2434 pfsync_push(b);
2435
2436 PFSYNC_BUCKET_UNLOCK(b);
2437 }
2438
2439 static void
pfsync_request_update(u_int32_t creatorid,u_int64_t id)2440 pfsync_request_update(u_int32_t creatorid, u_int64_t id)
2441 {
2442 struct pfsync_softc *sc = V_pfsyncif;
2443 struct pfsync_bucket *b = &sc->sc_buckets[0];
2444 struct pfsync_upd_req_item *item;
2445 size_t nlen = sizeof(struct pfsync_upd_req);
2446
2447 PFSYNC_BUCKET_LOCK_ASSERT(b);
2448
2449 /*
2450 * This code does a bit to prevent multiple update requests for the
2451 * same state being generated. It searches current subheader queue,
2452 * but it doesn't lookup into queue of already packed datagrams.
2453 */
2454 TAILQ_FOREACH(item, &b->b_upd_req_list, ur_entry)
2455 if (item->ur_msg.id == id &&
2456 item->ur_msg.creatorid == creatorid)
2457 return;
2458
2459 item = malloc(sizeof(*item), M_PFSYNC, M_NOWAIT);
2460 if (item == NULL)
2461 return; /* XXX stats */
2462
2463 item->ur_msg.id = id;
2464 item->ur_msg.creatorid = creatorid;
2465
2466 if (TAILQ_EMPTY(&b->b_upd_req_list))
2467 nlen += sizeof(struct pfsync_subheader);
2468
2469 if (b->b_len + nlen > sc->sc_ifp->if_mtu) {
2470 pfsync_sendout(0, 0);
2471
2472 nlen = sizeof(struct pfsync_subheader) +
2473 sizeof(struct pfsync_upd_req);
2474 }
2475
2476 TAILQ_INSERT_TAIL(&b->b_upd_req_list, item, ur_entry);
2477 b->b_len += nlen;
2478
2479 pfsync_push(b);
2480 }
2481
2482 static bool
pfsync_update_state_req(struct pf_kstate * st)2483 pfsync_update_state_req(struct pf_kstate *st)
2484 {
2485 struct pfsync_softc *sc = V_pfsyncif;
2486 bool ref = true, full = false;
2487 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2488
2489 PF_STATE_LOCK_ASSERT(st);
2490 PFSYNC_BUCKET_LOCK(b);
2491
2492 if (st->state_flags & PFSTATE_NOSYNC) {
2493 if (st->sync_state != PFSYNC_S_NONE)
2494 pfsync_q_del(st, true, b);
2495 PFSYNC_BUCKET_UNLOCK(b);
2496 return (full);
2497 }
2498
2499 switch (st->sync_state) {
2500 case PFSYNC_S_UPD_C:
2501 case PFSYNC_S_IACK:
2502 pfsync_q_del(st, false, b);
2503 ref = false;
2504 /* FALLTHROUGH */
2505
2506 case PFSYNC_S_NONE:
2507 pfsync_q_ins(st, PFSYNC_S_UPD, ref);
2508 pfsync_push(b);
2509 break;
2510
2511 case PFSYNC_S_INS:
2512 case PFSYNC_S_UPD:
2513 case PFSYNC_S_DEL_C:
2514 /* we're already handling it */
2515 break;
2516
2517 default:
2518 panic("%s: unexpected sync state %d", __func__, st->sync_state);
2519 }
2520
2521 if ((sc->sc_ifp->if_mtu - b->b_len) < sizeof(union pfsync_state_union))
2522 full = true;
2523
2524 PFSYNC_BUCKET_UNLOCK(b);
2525
2526 return (full);
2527 }
2528
2529 static void
pfsync_delete_state(struct pf_kstate * st)2530 pfsync_delete_state(struct pf_kstate *st)
2531 {
2532 struct pfsync_softc *sc = V_pfsyncif;
2533 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2534 bool ref = true;
2535
2536 PFSYNC_BUCKET_LOCK(b);
2537 if (st->state_flags & PFSTATE_ACK)
2538 pfsync_undefer_state_locked(st, 1);
2539 if (st->state_flags & PFSTATE_NOSYNC) {
2540 if (st->sync_state != PFSYNC_S_NONE)
2541 pfsync_q_del(st, true, b);
2542 PFSYNC_BUCKET_UNLOCK(b);
2543 return;
2544 }
2545
2546 if (b->b_len == PFSYNC_MINPKT)
2547 callout_reset(&b->b_tmo, 1 * hz, pfsync_timeout, b);
2548
2549 switch (st->sync_state) {
2550 case PFSYNC_S_INS:
2551 /* We never got to tell the world so just forget about it. */
2552 pfsync_q_del(st, true, b);
2553 break;
2554
2555 case PFSYNC_S_UPD_C:
2556 case PFSYNC_S_UPD:
2557 case PFSYNC_S_IACK:
2558 pfsync_q_del(st, false, b);
2559 ref = false;
2560 /* FALLTHROUGH */
2561
2562 case PFSYNC_S_NONE:
2563 pfsync_q_ins(st, PFSYNC_S_DEL_C, ref);
2564 break;
2565
2566 default:
2567 panic("%s: unexpected sync state %d", __func__, st->sync_state);
2568 }
2569
2570 PFSYNC_BUCKET_UNLOCK(b);
2571 }
2572
2573 static void
pfsync_clear_states(u_int32_t creatorid,const char * ifname)2574 pfsync_clear_states(u_int32_t creatorid, const char *ifname)
2575 {
2576 struct {
2577 struct pfsync_subheader subh;
2578 struct pfsync_clr clr;
2579 } __packed r;
2580
2581 bzero(&r, sizeof(r));
2582
2583 r.subh.action = PFSYNC_ACT_CLR;
2584 r.subh.count = htons(1);
2585 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_CLR]++;
2586
2587 strlcpy(r.clr.ifname, ifname, sizeof(r.clr.ifname));
2588 r.clr.creatorid = creatorid;
2589
2590 pfsync_send_plus(&r, sizeof(r));
2591 }
2592
2593 static enum pfsync_q_id
pfsync_sstate_to_qid(u_int8_t sync_state)2594 pfsync_sstate_to_qid(u_int8_t sync_state)
2595 {
2596 struct pfsync_softc *sc = V_pfsyncif;
2597
2598 switch (sync_state) {
2599 case PFSYNC_S_INS:
2600 switch (sc->sc_version) {
2601 case PFSYNC_MSG_VERSION_1301:
2602 return PFSYNC_Q_INS_1301;
2603 case PFSYNC_MSG_VERSION_1400:
2604 return PFSYNC_Q_INS_1400;
2605 case PFSYNC_MSG_VERSION_1500:
2606 return PFSYNC_Q_INS_1500;
2607 }
2608 break;
2609 case PFSYNC_S_IACK:
2610 return PFSYNC_Q_IACK;
2611 case PFSYNC_S_UPD:
2612 switch (sc->sc_version) {
2613 case PFSYNC_MSG_VERSION_1301:
2614 return PFSYNC_Q_UPD_1301;
2615 case PFSYNC_MSG_VERSION_1400:
2616 return PFSYNC_Q_UPD_1400;
2617 case PFSYNC_MSG_VERSION_1500:
2618 return PFSYNC_Q_UPD_1500;
2619 }
2620 break;
2621 case PFSYNC_S_UPD_C:
2622 return PFSYNC_Q_UPD_C;
2623 case PFSYNC_S_DEL_C:
2624 return PFSYNC_Q_DEL_C;
2625 default:
2626 panic("%s: Unsupported st->sync_state 0x%02x",
2627 __func__, sync_state);
2628 }
2629
2630 panic("%s: Unsupported pfsync_msg_version %d",
2631 __func__, sc->sc_version);
2632 }
2633
2634 static void
pfsync_q_ins(struct pf_kstate * st,int sync_state,bool ref)2635 pfsync_q_ins(struct pf_kstate *st, int sync_state, bool ref)
2636 {
2637 enum pfsync_q_id q = pfsync_sstate_to_qid(sync_state);
2638 struct pfsync_softc *sc = V_pfsyncif;
2639 size_t nlen = pfsync_qs[q].len;
2640 struct pfsync_bucket *b = pfsync_get_bucket(sc, st);
2641
2642 PFSYNC_BUCKET_LOCK_ASSERT(b);
2643
2644 KASSERT(st->sync_state == PFSYNC_S_NONE,
2645 ("%s: st->sync_state %u", __func__, st->sync_state));
2646 KASSERT(b->b_len >= PFSYNC_MINPKT, ("pfsync pkt len is too low %zu",
2647 b->b_len));
2648
2649 if (TAILQ_EMPTY(&b->b_qs[q]))
2650 nlen += sizeof(struct pfsync_subheader);
2651
2652 if (b->b_len + nlen > sc->sc_ifp->if_mtu) {
2653 pfsync_sendout(1, b->b_id);
2654
2655 nlen = sizeof(struct pfsync_subheader) + pfsync_qs[q].len;
2656 }
2657
2658 b->b_len += nlen;
2659 st->sync_state = pfsync_qid_sstate[q];
2660 TAILQ_INSERT_TAIL(&b->b_qs[q], st, sync_list);
2661 if (ref)
2662 pf_ref_state(st);
2663 }
2664
2665 static void
pfsync_q_del(struct pf_kstate * st,bool unref,struct pfsync_bucket * b)2666 pfsync_q_del(struct pf_kstate *st, bool unref, struct pfsync_bucket *b)
2667 {
2668 enum pfsync_q_id q;
2669
2670 PFSYNC_BUCKET_LOCK_ASSERT(b);
2671 KASSERT(st->sync_state != PFSYNC_S_NONE,
2672 ("%s: st->sync_state != PFSYNC_S_NONE", __func__));
2673
2674 q = pfsync_sstate_to_qid(st->sync_state);
2675 b->b_len -= pfsync_qs[q].len;
2676 TAILQ_REMOVE(&b->b_qs[q], st, sync_list);
2677 st->sync_state = PFSYNC_S_NONE;
2678 if (unref)
2679 pf_release_state(st);
2680
2681 if (TAILQ_EMPTY(&b->b_qs[q]))
2682 b->b_len -= sizeof(struct pfsync_subheader);
2683 }
2684
2685 static void
pfsync_bulk_start(void)2686 pfsync_bulk_start(void)
2687 {
2688 struct pfsync_softc *sc = V_pfsyncif;
2689
2690 if (V_pf_status.debug >= PF_DEBUG_MISC)
2691 printf("pfsync: received bulk update request\n");
2692
2693 PFSYNC_BLOCK(sc);
2694
2695 sc->sc_ureq_received = time_uptime;
2696 sc->sc_bulk_hashid = 0;
2697 sc->sc_bulk_stateid = 0;
2698 pfsync_bulk_status(PFSYNC_BUS_START);
2699 callout_reset(&sc->sc_bulk_tmo, 1, pfsync_bulk_update, sc);
2700 PFSYNC_BUNLOCK(sc);
2701 }
2702
2703 static void
pfsync_bulk_update(void * arg)2704 pfsync_bulk_update(void *arg)
2705 {
2706 struct pfsync_softc *sc = arg;
2707 struct pf_kstate *s;
2708 int i;
2709
2710 PFSYNC_BLOCK_ASSERT(sc);
2711 CURVNET_SET(sc->sc_ifp->if_vnet);
2712
2713 /*
2714 * Start with last state from previous invocation.
2715 * It may had gone, in this case start from the
2716 * hash slot.
2717 */
2718 s = pf_find_state_byid(sc->sc_bulk_stateid, sc->sc_bulk_creatorid);
2719
2720 if (s != NULL)
2721 i = PF_IDHASH(s);
2722 else
2723 i = sc->sc_bulk_hashid;
2724
2725 for (; i <= V_pf_hashmask; i++) {
2726 struct pf_idhash *ih = &V_pf_idhash[i];
2727
2728 if (s != NULL)
2729 PF_HASHROW_ASSERT(ih);
2730 else {
2731 PF_HASHROW_LOCK(ih);
2732 s = LIST_FIRST(&ih->states);
2733 }
2734
2735 for (; s; s = LIST_NEXT(s, entry)) {
2736 if (s->sync_state == PFSYNC_S_NONE &&
2737 s->timeout < PFTM_MAX &&
2738 s->pfsync_time <= sc->sc_ureq_received) {
2739 if (pfsync_update_state_req(s)) {
2740 /* We've filled a packet. */
2741 sc->sc_bulk_hashid = i;
2742 sc->sc_bulk_stateid = s->id;
2743 sc->sc_bulk_creatorid = s->creatorid;
2744 PF_HASHROW_UNLOCK(ih);
2745 callout_reset(&sc->sc_bulk_tmo, 1,
2746 pfsync_bulk_update, sc);
2747 goto full;
2748 }
2749 }
2750 }
2751 PF_HASHROW_UNLOCK(ih);
2752 }
2753
2754 /* We're done. */
2755 pfsync_bulk_status(PFSYNC_BUS_END);
2756 full:
2757 CURVNET_RESTORE();
2758 }
2759
2760 static void
pfsync_bulk_status(u_int8_t status)2761 pfsync_bulk_status(u_int8_t status)
2762 {
2763 struct {
2764 struct pfsync_subheader subh;
2765 struct pfsync_bus bus;
2766 } __packed r;
2767
2768 struct pfsync_softc *sc = V_pfsyncif;
2769
2770 bzero(&r, sizeof(r));
2771
2772 r.subh.action = PFSYNC_ACT_BUS;
2773 r.subh.count = htons(1);
2774 V_pfsyncstats.pfsyncs_oacts[PFSYNC_ACT_BUS]++;
2775
2776 r.bus.creatorid = V_pf_status.hostid;
2777 r.bus.endtime = htonl(time_uptime - sc->sc_ureq_received);
2778 r.bus.status = status;
2779
2780 pfsync_send_plus(&r, sizeof(r));
2781 }
2782
2783 static void
pfsync_bulk_fail(void * arg)2784 pfsync_bulk_fail(void *arg)
2785 {
2786 struct pfsync_softc *sc = arg;
2787 struct pfsync_bucket *b = &sc->sc_buckets[0];
2788
2789 CURVNET_SET(sc->sc_ifp->if_vnet);
2790
2791 PFSYNC_BLOCK_ASSERT(sc);
2792
2793 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
2794 /* Try again */
2795 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
2796 pfsync_bulk_fail, V_pfsyncif);
2797 PFSYNC_BUCKET_LOCK(b);
2798 pfsync_request_update(0, 0);
2799 PFSYNC_BUCKET_UNLOCK(b);
2800 } else {
2801 /* Pretend like the transfer was ok. */
2802 sc->sc_ureq_sent = 0;
2803 sc->sc_bulk_tries = 0;
2804 PFSYNC_LOCK(sc);
2805 if (!(sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
2806 (*carp_demote_adj_p)(-V_pfsync_carp_adj,
2807 "pfsync bulk fail");
2808 sc->sc_flags |= PFSYNCF_OK;
2809 PFSYNC_UNLOCK(sc);
2810 if (V_pf_status.debug >= PF_DEBUG_MISC)
2811 printf("pfsync: failed to receive bulk update\n");
2812 }
2813
2814 CURVNET_RESTORE();
2815 }
2816
2817 static void
pfsync_send_plus(void * plus,size_t pluslen)2818 pfsync_send_plus(void *plus, size_t pluslen)
2819 {
2820 struct pfsync_softc *sc = V_pfsyncif;
2821 struct pfsync_bucket *b = &sc->sc_buckets[0];
2822 uint8_t *newplus;
2823
2824 PFSYNC_BUCKET_LOCK(b);
2825
2826 if (b->b_len + pluslen > sc->sc_ifp->if_mtu)
2827 pfsync_sendout(1, b->b_id);
2828
2829 newplus = malloc(pluslen + b->b_pluslen, M_PFSYNC, M_NOWAIT);
2830 if (newplus == NULL)
2831 goto out;
2832
2833 if (b->b_plus != NULL) {
2834 memcpy(newplus, b->b_plus, b->b_pluslen);
2835 free(b->b_plus, M_PFSYNC);
2836 } else {
2837 MPASS(b->b_pluslen == 0);
2838 }
2839 memcpy(newplus + b->b_pluslen, plus, pluslen);
2840
2841 b->b_plus = newplus;
2842 b->b_pluslen += pluslen;
2843 b->b_len += pluslen;
2844
2845 pfsync_sendout(1, b->b_id);
2846
2847 out:
2848 PFSYNC_BUCKET_UNLOCK(b);
2849 }
2850
2851 static void
pfsync_timeout(void * arg)2852 pfsync_timeout(void *arg)
2853 {
2854 struct pfsync_bucket *b = arg;
2855
2856 CURVNET_SET(b->b_sc->sc_ifp->if_vnet);
2857 PFSYNC_BUCKET_LOCK(b);
2858 pfsync_push(b);
2859 PFSYNC_BUCKET_UNLOCK(b);
2860 CURVNET_RESTORE();
2861 }
2862
2863 static void
pfsync_push(struct pfsync_bucket * b)2864 pfsync_push(struct pfsync_bucket *b)
2865 {
2866
2867 PFSYNC_BUCKET_LOCK_ASSERT(b);
2868
2869 b->b_flags |= PFSYNCF_BUCKET_PUSH;
2870 swi_sched(V_pfsync_swi_cookie, 0);
2871 }
2872
2873 static void
pfsync_push_all(struct pfsync_softc * sc)2874 pfsync_push_all(struct pfsync_softc *sc)
2875 {
2876 int c;
2877 struct pfsync_bucket *b;
2878
2879 for (c = 0; c < pfsync_buckets; c++) {
2880 b = &sc->sc_buckets[c];
2881
2882 PFSYNC_BUCKET_LOCK(b);
2883 pfsync_push(b);
2884 PFSYNC_BUCKET_UNLOCK(b);
2885 }
2886 }
2887
2888 static void
pfsync_tx(struct pfsync_softc * sc,struct mbuf * m)2889 pfsync_tx(struct pfsync_softc *sc, struct mbuf *m)
2890 {
2891 struct ip *ip;
2892 int af, error = 0;
2893
2894 ip = mtod(m, struct ip *);
2895 MPASS(ip->ip_v == IPVERSION || ip->ip_v == (IPV6_VERSION >> 4));
2896
2897 af = ip->ip_v == IPVERSION ? AF_INET : AF_INET6;
2898
2899 /*
2900 * We distinguish between a deferral packet and our
2901 * own pfsync packet based on M_SKIP_FIREWALL
2902 * flag. This is XXX.
2903 */
2904 switch (af) {
2905 #ifdef INET
2906 case AF_INET:
2907 if (m->m_flags & M_SKIP_FIREWALL) {
2908 error = ip_output(m, NULL, NULL, 0,
2909 NULL, NULL);
2910 } else {
2911 error = ip_output(m, NULL, NULL,
2912 IP_RAWOUTPUT, &sc->sc_imo, NULL);
2913 }
2914 break;
2915 #endif
2916 #ifdef INET6
2917 case AF_INET6:
2918 if (m->m_flags & M_SKIP_FIREWALL) {
2919 error = ip6_output(m, NULL, NULL, 0,
2920 NULL, NULL, NULL);
2921 } else {
2922 error = ip6_output(m, NULL, NULL, 0,
2923 &sc->sc_im6o, NULL, NULL);
2924 }
2925 break;
2926 #endif
2927 }
2928
2929 if (error == 0)
2930 V_pfsyncstats.pfsyncs_opackets++;
2931 else
2932 V_pfsyncstats.pfsyncs_oerrors++;
2933
2934 }
2935
2936 static void
pfsyncintr(void * arg)2937 pfsyncintr(void *arg)
2938 {
2939 struct epoch_tracker et;
2940 struct pfsync_softc *sc = arg;
2941 struct pfsync_bucket *b;
2942 struct mbuf *m, *n;
2943 int c;
2944
2945 NET_EPOCH_ENTER(et);
2946 CURVNET_SET(sc->sc_ifp->if_vnet);
2947
2948 for (c = 0; c < pfsync_buckets; c++) {
2949 b = &sc->sc_buckets[c];
2950
2951 PFSYNC_BUCKET_LOCK(b);
2952 if ((b->b_flags & PFSYNCF_BUCKET_PUSH) && b->b_len > PFSYNC_MINPKT) {
2953 pfsync_sendout(0, b->b_id);
2954 b->b_flags &= ~PFSYNCF_BUCKET_PUSH;
2955 }
2956 _IF_DEQUEUE_ALL(&b->b_snd, m);
2957 PFSYNC_BUCKET_UNLOCK(b);
2958
2959 for (; m != NULL; m = n) {
2960 n = m->m_nextpkt;
2961 m->m_nextpkt = NULL;
2962
2963 pfsync_tx(sc, m);
2964 }
2965 }
2966 CURVNET_RESTORE();
2967 NET_EPOCH_EXIT(et);
2968 }
2969
2970 static int
pfsync_multicast_setup(struct pfsync_softc * sc,struct ifnet * ifp,struct in_mfilter * imf,struct in6_mfilter * im6f)2971 pfsync_multicast_setup(struct pfsync_softc *sc, struct ifnet *ifp,
2972 struct in_mfilter* imf, struct in6_mfilter* im6f)
2973 {
2974 #ifdef INET
2975 struct ip_moptions *imo = &sc->sc_imo;
2976 #endif
2977 #ifdef INET6
2978 struct ip6_moptions *im6o = &sc->sc_im6o;
2979 struct sockaddr_in6 *syncpeer_sa6 = NULL;
2980 #endif
2981
2982 if (!(ifp->if_flags & IFF_MULTICAST))
2983 return (EADDRNOTAVAIL);
2984
2985 switch (sc->sc_sync_peer.ss_family) {
2986 #ifdef INET
2987 case AF_INET:
2988 {
2989 int error;
2990
2991 ip_mfilter_init(&imo->imo_head);
2992 imo->imo_multicast_vif = -1;
2993 if ((error = in_joingroup(ifp,
2994 &((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr, NULL,
2995 &imf->imf_inm)) != 0)
2996 return (error);
2997
2998 ip_mfilter_insert(&imo->imo_head, imf);
2999 imo->imo_multicast_ifp = ifp;
3000 imo->imo_multicast_ttl = PFSYNC_DFLTTL;
3001 imo->imo_multicast_loop = 0;
3002 break;
3003 }
3004 #endif
3005 #ifdef INET6
3006 case AF_INET6:
3007 {
3008 int error;
3009
3010 syncpeer_sa6 = (struct sockaddr_in6 *)&sc->sc_sync_peer;
3011 if ((error = in6_setscope(&syncpeer_sa6->sin6_addr, ifp, NULL)))
3012 return (error);
3013
3014 ip6_mfilter_init(&im6o->im6o_head);
3015 if ((error = in6_joingroup(ifp, &syncpeer_sa6->sin6_addr, NULL,
3016 &(im6f->im6f_in6m), 0)) != 0)
3017 return (error);
3018
3019 ip6_mfilter_insert(&im6o->im6o_head, im6f);
3020 im6o->im6o_multicast_ifp = ifp;
3021 im6o->im6o_multicast_hlim = PFSYNC_DFLTTL;
3022 im6o->im6o_multicast_loop = 0;
3023 break;
3024 }
3025 #endif
3026 }
3027
3028 return (0);
3029 }
3030
3031 static void
pfsync_multicast_cleanup(struct pfsync_softc * sc)3032 pfsync_multicast_cleanup(struct pfsync_softc *sc)
3033 {
3034 #ifdef INET
3035 struct ip_moptions *imo = &sc->sc_imo;
3036 struct in_mfilter *imf;
3037
3038 while ((imf = ip_mfilter_first(&imo->imo_head)) != NULL) {
3039 ip_mfilter_remove(&imo->imo_head, imf);
3040 in_leavegroup(imf->imf_inm, NULL);
3041 ip_mfilter_free(imf);
3042 }
3043 imo->imo_multicast_ifp = NULL;
3044 #endif
3045
3046 #ifdef INET6
3047 struct ip6_moptions *im6o = &sc->sc_im6o;
3048 struct in6_mfilter *im6f;
3049
3050 while ((im6f = ip6_mfilter_first(&im6o->im6o_head)) != NULL) {
3051 ip6_mfilter_remove(&im6o->im6o_head, im6f);
3052 in6_leavegroup(im6f->im6f_in6m, NULL);
3053 ip6_mfilter_free(im6f);
3054 }
3055 im6o->im6o_multicast_ifp = NULL;
3056 #endif
3057 }
3058
3059 void
pfsync_detach_ifnet(struct ifnet * ifp)3060 pfsync_detach_ifnet(struct ifnet *ifp)
3061 {
3062 struct pfsync_softc *sc = V_pfsyncif;
3063
3064 if (sc == NULL)
3065 return;
3066
3067 PFSYNC_LOCK(sc);
3068
3069 if (sc->sc_sync_if == ifp) {
3070 /* We don't need mutlicast cleanup here, because the interface
3071 * is going away. We do need to ensure we don't try to do
3072 * cleanup later.
3073 */
3074 ip_mfilter_init(&sc->sc_imo.imo_head);
3075 sc->sc_imo.imo_multicast_ifp = NULL;
3076 sc->sc_im6o.im6o_multicast_ifp = NULL;
3077 sc->sc_sync_if = NULL;
3078 }
3079
3080 PFSYNC_UNLOCK(sc);
3081 }
3082
3083 static int
pfsync_pfsyncreq_to_kstatus(struct pfsyncreq * pfsyncr,struct pfsync_kstatus * status)3084 pfsync_pfsyncreq_to_kstatus(struct pfsyncreq *pfsyncr, struct pfsync_kstatus *status)
3085 {
3086 struct sockaddr_storage sa;
3087 status->maxupdates = pfsyncr->pfsyncr_maxupdates;
3088 status->flags = pfsyncr->pfsyncr_defer;
3089
3090 strlcpy(status->syncdev, pfsyncr->pfsyncr_syncdev, IFNAMSIZ);
3091
3092 memset(&sa, 0, sizeof(sa));
3093 if (pfsyncr->pfsyncr_syncpeer.s_addr != 0) {
3094 struct sockaddr_in *in = (struct sockaddr_in *)&sa;
3095 in->sin_family = AF_INET;
3096 in->sin_len = sizeof(*in);
3097 in->sin_addr.s_addr = pfsyncr->pfsyncr_syncpeer.s_addr;
3098 }
3099 status->syncpeer = sa;
3100
3101 return 0;
3102 }
3103
3104 static int
pfsync_kstatus_to_softc(struct pfsync_kstatus * status,struct pfsync_softc * sc)3105 pfsync_kstatus_to_softc(struct pfsync_kstatus *status, struct pfsync_softc *sc)
3106 {
3107 struct ifnet *sifp;
3108 struct in_mfilter *imf = NULL;
3109 struct in6_mfilter *im6f = NULL;
3110 int error;
3111 int c;
3112
3113 if ((status->maxupdates < 0) || (status->maxupdates > 255))
3114 return (EINVAL);
3115
3116 if (status->syncdev[0] == '\0')
3117 sifp = NULL;
3118 else if ((sifp = ifunit_ref(status->syncdev)) == NULL)
3119 return (EINVAL);
3120
3121 switch (status->syncpeer.ss_family) {
3122 #ifdef INET
3123 case AF_UNSPEC:
3124 case AF_INET: {
3125 struct sockaddr_in *status_sin;
3126 status_sin = (struct sockaddr_in *)&(status->syncpeer);
3127 if (sifp != NULL) {
3128 if (status_sin->sin_addr.s_addr == 0 ||
3129 status_sin->sin_addr.s_addr ==
3130 htonl(INADDR_PFSYNC_GROUP)) {
3131 status_sin->sin_family = AF_INET;
3132 status_sin->sin_len = sizeof(*status_sin);
3133 status_sin->sin_addr.s_addr =
3134 htonl(INADDR_PFSYNC_GROUP);
3135 }
3136
3137 if (IN_MULTICAST(ntohl(status_sin->sin_addr.s_addr))) {
3138 imf = ip_mfilter_alloc(M_WAITOK, 0, 0);
3139 }
3140 }
3141 break;
3142 }
3143 #endif
3144 #ifdef INET6
3145 case AF_INET6: {
3146 struct sockaddr_in6 *status_sin6;
3147 status_sin6 = (struct sockaddr_in6*)&(status->syncpeer);
3148 if (sifp != NULL) {
3149 if (IN6_IS_ADDR_UNSPECIFIED(&status_sin6->sin6_addr) ||
3150 IN6_ARE_ADDR_EQUAL(&status_sin6->sin6_addr,
3151 &in6addr_linklocal_pfsync_group)) {
3152 status_sin6->sin6_family = AF_INET6;
3153 status_sin6->sin6_len = sizeof(*status_sin6);
3154 status_sin6->sin6_addr =
3155 in6addr_linklocal_pfsync_group;
3156 }
3157
3158 if (IN6_IS_ADDR_MULTICAST(&status_sin6->sin6_addr)) {
3159 im6f = ip6_mfilter_alloc(M_WAITOK, 0, 0);
3160 }
3161 }
3162 break;
3163 }
3164 #endif
3165 }
3166
3167 PFSYNC_LOCK(sc);
3168
3169 switch (status->version) {
3170 case PFSYNC_MSG_VERSION_UNSPECIFIED:
3171 sc->sc_version = PFSYNC_MSG_VERSION_DEFAULT;
3172 break;
3173 case PFSYNC_MSG_VERSION_1301:
3174 case PFSYNC_MSG_VERSION_1400:
3175 case PFSYNC_MSG_VERSION_1500:
3176 sc->sc_version = status->version;
3177 break;
3178 default:
3179 PFSYNC_UNLOCK(sc);
3180 return (EINVAL);
3181 }
3182
3183 switch (status->syncpeer.ss_family) {
3184 case AF_INET: {
3185 struct sockaddr_in *status_sin = (struct sockaddr_in *)&(status->syncpeer);
3186 struct sockaddr_in *sc_sin = (struct sockaddr_in *)&sc->sc_sync_peer;
3187 sc_sin->sin_family = AF_INET;
3188 sc_sin->sin_len = sizeof(*sc_sin);
3189 if (status_sin->sin_addr.s_addr == 0) {
3190 sc_sin->sin_addr.s_addr = htonl(INADDR_PFSYNC_GROUP);
3191 } else {
3192 sc_sin->sin_addr.s_addr = status_sin->sin_addr.s_addr;
3193 }
3194 break;
3195 }
3196 case AF_INET6: {
3197 struct sockaddr_in6 *status_sin = (struct sockaddr_in6 *)&(status->syncpeer);
3198 struct sockaddr_in6 *sc_sin = (struct sockaddr_in6 *)&sc->sc_sync_peer;
3199 sc_sin->sin6_family = AF_INET6;
3200 sc_sin->sin6_len = sizeof(*sc_sin);
3201 if(IN6_IS_ADDR_UNSPECIFIED(&status_sin->sin6_addr)) {
3202 sc_sin->sin6_addr = in6addr_linklocal_pfsync_group;
3203 } else {
3204 sc_sin->sin6_addr = status_sin->sin6_addr;
3205 }
3206 break;
3207 }
3208 }
3209
3210 sc->sc_maxupdates = status->maxupdates;
3211 if (status->flags & PFSYNCF_DEFER) {
3212 sc->sc_flags |= PFSYNCF_DEFER;
3213 V_pfsync_defer_ptr = pfsync_defer;
3214 } else {
3215 sc->sc_flags &= ~PFSYNCF_DEFER;
3216 V_pfsync_defer_ptr = NULL;
3217 }
3218
3219 if (sifp == NULL) {
3220 if (sc->sc_sync_if)
3221 if_rele(sc->sc_sync_if);
3222 sc->sc_sync_if = NULL;
3223 pfsync_multicast_cleanup(sc);
3224 PFSYNC_UNLOCK(sc);
3225 return (0);
3226 }
3227
3228 for (c = 0; c < pfsync_buckets; c++) {
3229 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[c]);
3230 if (sc->sc_buckets[c].b_len > PFSYNC_MINPKT &&
3231 (sifp->if_mtu < sc->sc_ifp->if_mtu ||
3232 (sc->sc_sync_if != NULL &&
3233 sifp->if_mtu < sc->sc_sync_if->if_mtu) ||
3234 sifp->if_mtu < MCLBYTES - sizeof(struct ip)))
3235 pfsync_sendout(1, c);
3236 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[c]);
3237 }
3238
3239 pfsync_multicast_cleanup(sc);
3240
3241 if (((sc->sc_sync_peer.ss_family == AF_INET) &&
3242 IN_MULTICAST(ntohl(((struct sockaddr_in *)
3243 &sc->sc_sync_peer)->sin_addr.s_addr))) ||
3244 ((sc->sc_sync_peer.ss_family == AF_INET6) &&
3245 IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6*)
3246 &sc->sc_sync_peer)->sin6_addr))) {
3247 error = pfsync_multicast_setup(sc, sifp, imf, im6f);
3248 if (error) {
3249 if_rele(sifp);
3250 PFSYNC_UNLOCK(sc);
3251 #ifdef INET
3252 if (imf != NULL)
3253 ip_mfilter_free(imf);
3254 #endif
3255 #ifdef INET6
3256 if (im6f != NULL)
3257 ip6_mfilter_free(im6f);
3258 #endif
3259 return (error);
3260 }
3261 }
3262 if (sc->sc_sync_if)
3263 if_rele(sc->sc_sync_if);
3264 sc->sc_sync_if = sifp;
3265
3266 switch (sc->sc_sync_peer.ss_family) {
3267 #ifdef INET
3268 case AF_INET: {
3269 struct ip *ip;
3270 ip = &sc->sc_template.ipv4;
3271 bzero(ip, sizeof(*ip));
3272 ip->ip_v = IPVERSION;
3273 ip->ip_hl = sizeof(sc->sc_template.ipv4) >> 2;
3274 ip->ip_tos = IPTOS_LOWDELAY;
3275 /* len and id are set later. */
3276 ip->ip_off = htons(IP_DF);
3277 ip->ip_ttl = PFSYNC_DFLTTL;
3278 ip->ip_p = IPPROTO_PFSYNC;
3279 ip->ip_src.s_addr = INADDR_ANY;
3280 ip->ip_dst = ((struct sockaddr_in *)&sc->sc_sync_peer)->sin_addr;
3281 break;
3282 }
3283 #endif
3284 #ifdef INET6
3285 case AF_INET6: {
3286 struct ip6_hdr *ip6;
3287 ip6 = &sc->sc_template.ipv6;
3288 bzero(ip6, sizeof(*ip6));
3289 ip6->ip6_vfc = IPV6_VERSION;
3290 ip6->ip6_hlim = PFSYNC_DFLTTL;
3291 ip6->ip6_nxt = IPPROTO_PFSYNC;
3292 ip6->ip6_dst = ((struct sockaddr_in6 *)&sc->sc_sync_peer)->sin6_addr;
3293
3294 struct epoch_tracker et;
3295 NET_EPOCH_ENTER(et);
3296 in6_selectsrc_addr(if_getfib(sc->sc_sync_if), &ip6->ip6_dst, 0,
3297 sc->sc_sync_if, &ip6->ip6_src, NULL);
3298 NET_EPOCH_EXIT(et);
3299 break;
3300 }
3301 #endif
3302 }
3303
3304 /* Request a full state table update. */
3305 if ((sc->sc_flags & PFSYNCF_OK) && carp_demote_adj_p)
3306 (*carp_demote_adj_p)(V_pfsync_carp_adj,
3307 "pfsync bulk start");
3308 sc->sc_flags &= ~PFSYNCF_OK;
3309 if (V_pf_status.debug >= PF_DEBUG_MISC)
3310 printf("pfsync: requesting bulk update\n");
3311 PFSYNC_UNLOCK(sc);
3312 PFSYNC_BUCKET_LOCK(&sc->sc_buckets[0]);
3313 pfsync_request_update(0, 0);
3314 PFSYNC_BUCKET_UNLOCK(&sc->sc_buckets[0]);
3315 PFSYNC_BLOCK(sc);
3316 sc->sc_ureq_sent = time_uptime;
3317 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulk_fail, sc);
3318 PFSYNC_BUNLOCK(sc);
3319 return (0);
3320 }
3321
3322 static void
pfsync_pointers_init(void)3323 pfsync_pointers_init(void)
3324 {
3325
3326 PF_RULES_WLOCK();
3327 V_pfsync_state_import_ptr = pfsync_state_import;
3328 V_pfsync_insert_state_ptr = pfsync_insert_state;
3329 V_pfsync_update_state_ptr = pfsync_update_state;
3330 V_pfsync_delete_state_ptr = pfsync_delete_state;
3331 V_pfsync_clear_states_ptr = pfsync_clear_states;
3332 V_pfsync_defer_ptr = pfsync_defer;
3333 PF_RULES_WUNLOCK();
3334 }
3335
3336 static void
pfsync_pointers_uninit(void)3337 pfsync_pointers_uninit(void)
3338 {
3339
3340 PF_RULES_WLOCK();
3341 V_pfsync_state_import_ptr = NULL;
3342 V_pfsync_insert_state_ptr = NULL;
3343 V_pfsync_update_state_ptr = NULL;
3344 V_pfsync_delete_state_ptr = NULL;
3345 V_pfsync_clear_states_ptr = NULL;
3346 V_pfsync_defer_ptr = NULL;
3347 PF_RULES_WUNLOCK();
3348 }
3349
3350 static void
vnet_pfsync_init(const void * unused __unused)3351 vnet_pfsync_init(const void *unused __unused)
3352 {
3353 int error;
3354
3355 V_pfsync_cloner = if_clone_simple(pfsyncname,
3356 pfsync_clone_create, pfsync_clone_destroy, 1);
3357 error = swi_add(&V_pfsync_swi_ie, pfsyncname, pfsyncintr, V_pfsyncif,
3358 SWI_NET, INTR_MPSAFE, &V_pfsync_swi_cookie);
3359 if (error) {
3360 if_clone_detach(V_pfsync_cloner);
3361 log(LOG_INFO, "swi_add() failed in %s\n", __func__);
3362 }
3363
3364 pfsync_pointers_init();
3365 }
3366 VNET_SYSINIT(vnet_pfsync_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY,
3367 vnet_pfsync_init, NULL);
3368
3369 static void
vnet_pfsync_uninit(const void * unused __unused)3370 vnet_pfsync_uninit(const void *unused __unused)
3371 {
3372 int ret __diagused;
3373
3374 pfsync_pointers_uninit();
3375
3376 if_clone_detach(V_pfsync_cloner);
3377 ret = swi_remove(V_pfsync_swi_cookie);
3378 MPASS(ret == 0);
3379 ret = intr_event_destroy(V_pfsync_swi_ie);
3380 MPASS(ret == 0);
3381 }
3382
3383 VNET_SYSUNINIT(vnet_pfsync_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_FOURTH,
3384 vnet_pfsync_uninit, NULL);
3385
3386 static int
pfsync_init(void)3387 pfsync_init(void)
3388 {
3389 int error;
3390
3391 pfsync_detach_ifnet_ptr = pfsync_detach_ifnet;
3392
3393 #ifdef INET
3394 error = ipproto_register(IPPROTO_PFSYNC, pfsync_input, NULL);
3395 if (error)
3396 return (error);
3397 #endif
3398 #ifdef INET6
3399 error = ip6proto_register(IPPROTO_PFSYNC, pfsync6_input, NULL);
3400 if (error) {
3401 ipproto_unregister(IPPROTO_PFSYNC);
3402 return (error);
3403 }
3404 #endif
3405
3406 return (0);
3407 }
3408
3409 static void
pfsync_uninit(void)3410 pfsync_uninit(void)
3411 {
3412 pfsync_detach_ifnet_ptr = NULL;
3413
3414 #ifdef INET
3415 ipproto_unregister(IPPROTO_PFSYNC);
3416 #endif
3417 #ifdef INET6
3418 ip6proto_unregister(IPPROTO_PFSYNC);
3419 #endif
3420 }
3421
3422 static int
pfsync_modevent(module_t mod,int type,void * data)3423 pfsync_modevent(module_t mod, int type, void *data)
3424 {
3425 int error = 0;
3426
3427 switch (type) {
3428 case MOD_LOAD:
3429 error = pfsync_init();
3430 break;
3431 case MOD_UNLOAD:
3432 pfsync_uninit();
3433 break;
3434 default:
3435 error = EINVAL;
3436 break;
3437 }
3438
3439 return (error);
3440 }
3441
3442 static moduledata_t pfsync_mod = {
3443 pfsyncname,
3444 pfsync_modevent,
3445 0
3446 };
3447
3448 #define PFSYNC_MODVER 1
3449
3450 /* Stay on FIREWALL as we depend on pf being initialized and on inetdomain. */
3451 DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY);
3452 MODULE_VERSION(pfsync, PFSYNC_MODVER);
3453 MODULE_DEPEND(pfsync, pf, PF_MODVER, PF_MODVER, PF_MODVER);
3454