4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
8 #if defined(KERNEL) || defined(_KERNEL)
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
18 #if !defined(_KERNEL) && !defined(__KERNEL__)
31 # include <sys/systm.h>
32 # if !defined(__SVR4) && !defined(__svr4__)
33 # include <sys/mbuf.h>
35 # include <sys/select.h>
36 # if __FreeBSD_version >= 500000
37 # include <sys/selinfo.h>
40 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 104000000)
41 # include <sys/proc.h>
43 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
44 # include <sys/filio.h>
45 # include <sys/fcntl.h>
47 # include <sys/ioctl.h>
51 # include <sys/protosw.h>
53 #include <sys/socket.h>
54 #if defined(__SVR4) || defined(__svr4__)
55 # include <sys/filio.h>
56 # include <sys/byteorder.h>
58 # include <sys/dditypes.h>
60 # include <sys/stream.h>
61 # include <sys/kmem.h>
68 #include <netinet/in.h>
69 #include <netinet/in_systm.h>
70 #include <netinet/ip.h>
71 #include <netinet/tcp.h>
73 # include <netinet/ip_var.h>
75 #if !defined(__hpux) && !defined(linux)
76 # include <netinet/tcp_fsm.h>
78 #include <netinet/udp.h>
79 #include <netinet/ip_icmp.h>
80 #include "netinet/ip_compat.h"
81 #include <netinet/tcpip.h>
82 #include "netinet/ip_fil.h"
83 #include "netinet/ip_nat.h"
84 #include "netinet/ip_frag.h"
85 #include "netinet/ip_state.h"
86 #include "netinet/ip_proxy.h"
87 #include "netinet/ip_sync.h"
89 #include <netinet/icmp6.h>
91 #if (__FreeBSD_version >= 300000)
92 # include <sys/malloc.h>
93 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
94 # include <sys/libkern.h>
95 # include <sys/systm.h>
101 static const char rcsid[] = "@(#)$Id$";
104 #define SYNC_STATETABSZ 256
105 #define SYNC_NATTABSZ 256
107 typedef struct ipf_sync_softc_s {
108 ipfmutex_t ipf_syncadd;
109 ipfmutex_t ipsl_mutex;
110 ipfrwlock_t ipf_syncstate;
111 ipfrwlock_t ipf_syncnat;
112 #if SOLARIS && defined(_KERNEL)
115 #if defined(linux) && defined(_KERNEL)
116 wait_queue_head_t sl_tail_linux;
118 synclist_t **syncstatetab;
119 synclist_t **syncnattab;
120 synclogent_t *synclog;
121 syncupdent_t *syncupd;
124 u_int sl_idx; /* next available sync log entry */
125 u_int su_idx; /* next available sync update entry */
126 u_int sl_tail; /* next sync log entry to read */
127 u_int su_tail; /* next sync update entry to read */
129 int ipf_sync_nat_tab_sz;
130 int ipf_sync_state_tab_sz;
133 u_32_t ipf_sync_lastwakeup;
134 int ipf_sync_wake_interval;
135 int ipf_sync_event_high_wm;
136 int ipf_sync_queue_high_wm;
140 static int ipf_sync_flush_table __P((ipf_sync_softc_t *, int, synclist_t **));
141 static void ipf_sync_wakeup __P((ipf_main_softc_t *));
142 static void ipf_sync_del __P((ipf_sync_softc_t *, synclist_t *));
143 static void ipf_sync_poll_wakeup __P((ipf_main_softc_t *));
144 static int ipf_sync_nat __P((ipf_main_softc_t *, synchdr_t *, void *));
145 static int ipf_sync_state __P((ipf_main_softc_t *, synchdr_t *, void *));
147 # if !defined(sparc) && !defined(__hppa)
148 void ipf_sync_tcporder __P((int, struct tcpdata *));
149 void ipf_sync_natorder __P((int, struct nat *));
150 void ipf_sync_storder __P((int, struct ipstate *));
155 ipf_sync_soft_create(softc)
156 ipf_main_softc_t *softc;
158 ipf_sync_softc_t *softs;
160 KMALLOC(softs, ipf_sync_softc_t *);
166 bzero((char *)softs, sizeof(*softs));
168 softs->ipf_sync_log_sz = SYNCLOG_SZ;
169 softs->ipf_sync_nat_tab_sz = SYNC_STATETABSZ;
170 softs->ipf_sync_state_tab_sz = SYNC_STATETABSZ;
171 softs->ipf_sync_event_high_wm = SYNCLOG_SZ * 100 / 90; /* 90% */
172 softs->ipf_sync_queue_high_wm = SYNCLOG_SZ * 100 / 90; /* 90% */
178 /* ------------------------------------------------------------------------ */
179 /* Function: ipf_sync_init */
180 /* Returns: int - 0 == success, -1 == failure */
181 /* Parameters: Nil */
183 /* Initialise all of the locks required for the sync code and initialise */
184 /* any data structures, as required. */
185 /* ------------------------------------------------------------------------ */
187 ipf_sync_soft_init(softc, arg)
188 ipf_main_softc_t *softc;
191 ipf_sync_softc_t *softs = arg;
193 KMALLOCS(softs->synclog, synclogent_t *,
194 softs->ipf_sync_log_sz * sizeof(*softs->synclog));
195 if (softs->synclog == NULL)
197 bzero((char *)softs->synclog,
198 softs->ipf_sync_log_sz * sizeof(*softs->synclog));
200 KMALLOCS(softs->syncupd, syncupdent_t *,
201 softs->ipf_sync_log_sz * sizeof(*softs->syncupd));
202 if (softs->syncupd == NULL)
204 bzero((char *)softs->syncupd,
205 softs->ipf_sync_log_sz * sizeof(*softs->syncupd));
207 KMALLOCS(softs->syncstatetab, synclist_t **,
208 softs->ipf_sync_state_tab_sz * sizeof(*softs->syncstatetab));
209 if (softs->syncstatetab == NULL)
211 bzero((char *)softs->syncstatetab,
212 softs->ipf_sync_state_tab_sz * sizeof(*softs->syncstatetab));
214 KMALLOCS(softs->syncnattab, synclist_t **,
215 softs->ipf_sync_nat_tab_sz * sizeof(*softs->syncnattab));
216 if (softs->syncnattab == NULL)
218 bzero((char *)softs->syncnattab,
219 softs->ipf_sync_nat_tab_sz * sizeof(*softs->syncnattab));
221 softs->ipf_sync_num = 1;
222 softs->ipf_sync_wrap = 0;
227 softs->ipf_sync_events = 0;
228 softs->ipf_sync_lastwakeup = 0;
231 # if SOLARIS && defined(_KERNEL)
232 cv_init(&softs->ipslwait, "ipsl condvar", CV_DRIVER, NULL);
234 RWLOCK_INIT(&softs->ipf_syncstate, "add things to state sync table");
235 RWLOCK_INIT(&softs->ipf_syncnat, "add things to nat sync table");
236 MUTEX_INIT(&softs->ipf_syncadd, "add things to sync table");
237 MUTEX_INIT(&softs->ipsl_mutex, "read ring lock");
239 softs->ipf_sync_inited = 1;
245 /* ------------------------------------------------------------------------ */
246 /* Function: ipf_sync_unload */
247 /* Returns: int - 0 == success, -1 == failure */
248 /* Parameters: Nil */
250 /* Destroy the locks created when initialising and free any memory in use */
251 /* with the synchronisation tables. */
252 /* ------------------------------------------------------------------------ */
254 ipf_sync_soft_fini(softc, arg)
255 ipf_main_softc_t *softc;
258 ipf_sync_softc_t *softs = arg;
260 if (softs->syncnattab != NULL) {
261 ipf_sync_flush_table(softs, softs->ipf_sync_nat_tab_sz,
263 KFREES(softs->syncnattab,
264 softs->ipf_sync_nat_tab_sz * sizeof(*softs->syncnattab));
265 softs->syncnattab = NULL;
268 if (softs->syncstatetab != NULL) {
269 ipf_sync_flush_table(softs, softs->ipf_sync_state_tab_sz,
270 softs->syncstatetab);
271 KFREES(softs->syncstatetab,
272 softs->ipf_sync_state_tab_sz *
273 sizeof(*softs->syncstatetab));
274 softs->syncstatetab = NULL;
277 if (softs->syncupd != NULL) {
278 KFREES(softs->syncupd,
279 softs->ipf_sync_log_sz * sizeof(*softs->syncupd));
280 softs->syncupd = NULL;
283 if (softs->synclog != NULL) {
284 KFREES(softs->synclog,
285 softs->ipf_sync_log_sz * sizeof(*softs->synclog));
286 softs->synclog = NULL;
289 if (softs->ipf_sync_inited == 1) {
290 MUTEX_DESTROY(&softs->ipsl_mutex);
291 MUTEX_DESTROY(&softs->ipf_syncadd);
292 RW_DESTROY(&softs->ipf_syncnat);
293 RW_DESTROY(&softs->ipf_syncstate);
294 softs->ipf_sync_inited = 0;
301 ipf_sync_soft_destroy(softc, arg)
302 ipf_main_softc_t *softc;
305 ipf_sync_softc_t *softs = arg;
311 # if !defined(sparc) && !defined(__hppa)
312 /* ------------------------------------------------------------------------ */
313 /* Function: ipf_sync_tcporder */
315 /* Parameters: way(I) - direction of byte order conversion. */
316 /* td(IO) - pointer to data to be converted. */
318 /* Do byte swapping on values in the TCP state information structure that */
319 /* need to be used at both ends by the host in their native byte order. */
320 /* ------------------------------------------------------------------------ */
322 ipf_sync_tcporder(way, td)
327 td->td_maxwin = htons(td->td_maxwin);
328 td->td_end = htonl(td->td_end);
329 td->td_maxend = htonl(td->td_maxend);
331 td->td_maxwin = ntohs(td->td_maxwin);
332 td->td_end = ntohl(td->td_end);
333 td->td_maxend = ntohl(td->td_maxend);
338 /* ------------------------------------------------------------------------ */
339 /* Function: ipf_sync_natorder */
341 /* Parameters: way(I) - direction of byte order conversion. */
342 /* nat(IO) - pointer to data to be converted. */
344 /* Do byte swapping on values in the NAT data structure that need to be */
345 /* used at both ends by the host in their native byte order. */
346 /* ------------------------------------------------------------------------ */
348 ipf_sync_natorder(way, n)
353 n->nat_age = htonl(n->nat_age);
354 n->nat_flags = htonl(n->nat_flags);
355 n->nat_ipsumd = htonl(n->nat_ipsumd);
356 n->nat_use = htonl(n->nat_use);
357 n->nat_dir = htonl(n->nat_dir);
359 n->nat_age = ntohl(n->nat_age);
360 n->nat_flags = ntohl(n->nat_flags);
361 n->nat_ipsumd = ntohl(n->nat_ipsumd);
362 n->nat_use = ntohl(n->nat_use);
363 n->nat_dir = ntohl(n->nat_dir);
368 /* ------------------------------------------------------------------------ */
369 /* Function: ipf_sync_storder */
371 /* Parameters: way(I) - direction of byte order conversion. */
372 /* ips(IO) - pointer to data to be converted. */
374 /* Do byte swapping on values in the IP state data structure that need to */
375 /* be used at both ends by the host in their native byte order. */
376 /* ------------------------------------------------------------------------ */
378 ipf_sync_storder(way, ips)
382 ipf_sync_tcporder(way, &ips->is_tcp.ts_data[0]);
383 ipf_sync_tcporder(way, &ips->is_tcp.ts_data[1]);
386 ips->is_hv = htonl(ips->is_hv);
387 ips->is_die = htonl(ips->is_die);
388 ips->is_pass = htonl(ips->is_pass);
389 ips->is_flags = htonl(ips->is_flags);
390 ips->is_opt[0] = htonl(ips->is_opt[0]);
391 ips->is_opt[1] = htonl(ips->is_opt[1]);
392 ips->is_optmsk[0] = htonl(ips->is_optmsk[0]);
393 ips->is_optmsk[1] = htonl(ips->is_optmsk[1]);
394 ips->is_sec = htons(ips->is_sec);
395 ips->is_secmsk = htons(ips->is_secmsk);
396 ips->is_auth = htons(ips->is_auth);
397 ips->is_authmsk = htons(ips->is_authmsk);
398 ips->is_s0[0] = htonl(ips->is_s0[0]);
399 ips->is_s0[1] = htonl(ips->is_s0[1]);
400 ips->is_smsk[0] = htons(ips->is_smsk[0]);
401 ips->is_smsk[1] = htons(ips->is_smsk[1]);
403 ips->is_hv = ntohl(ips->is_hv);
404 ips->is_die = ntohl(ips->is_die);
405 ips->is_pass = ntohl(ips->is_pass);
406 ips->is_flags = ntohl(ips->is_flags);
407 ips->is_opt[0] = ntohl(ips->is_opt[0]);
408 ips->is_opt[1] = ntohl(ips->is_opt[1]);
409 ips->is_optmsk[0] = ntohl(ips->is_optmsk[0]);
410 ips->is_optmsk[1] = ntohl(ips->is_optmsk[1]);
411 ips->is_sec = ntohs(ips->is_sec);
412 ips->is_secmsk = ntohs(ips->is_secmsk);
413 ips->is_auth = ntohs(ips->is_auth);
414 ips->is_authmsk = ntohs(ips->is_authmsk);
415 ips->is_s0[0] = ntohl(ips->is_s0[0]);
416 ips->is_s0[1] = ntohl(ips->is_s0[1]);
417 ips->is_smsk[0] = ntohl(ips->is_smsk[0]);
418 ips->is_smsk[1] = ntohl(ips->is_smsk[1]);
421 # else /* !defined(sparc) && !defined(__hppa) */
422 # define ipf_sync_tcporder(x,y)
423 # define ipf_sync_natorder(x,y)
424 # define ipf_sync_storder(x,y)
425 # endif /* !defined(sparc) && !defined(__hppa) */
428 /* ------------------------------------------------------------------------ */
429 /* Function: ipf_sync_write */
430 /* Returns: int - 0 == success, else error value. */
431 /* Parameters: uio(I) - pointer to information about data to write */
433 /* Moves data from user space into the kernel and uses it for updating data */
434 /* structures in the state/NAT tables. */
435 /* ------------------------------------------------------------------------ */
437 ipf_sync_write(softc, uio)
438 ipf_main_softc_t *softc;
441 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
445 * THIS MUST BE SUFFICIENT LARGE TO STORE
446 * ANY POSSIBLE DATA TYPE
452 # if BSD_GE_YEAR(199306) || defined(__FreeBSD__) || defined(__osf__)
453 uio->uio_rw = UIO_WRITE;
456 /* Try to get bytes */
457 while (uio->uio_resid > 0) {
459 if (uio->uio_resid >= sizeof(sh)) {
461 err = UIOMOVE(&sh, sizeof(sh), UIO_WRITE, uio);
464 if (softs->ipf_sync_debug > 2)
465 printf("uiomove(header) failed: %d\n",
470 /* convert to host order */
471 sh.sm_magic = ntohl(sh.sm_magic);
472 sh.sm_len = ntohl(sh.sm_len);
473 sh.sm_num = ntohl(sh.sm_num);
475 if (softs->ipf_sync_debug > 8)
476 printf("[%d] Read v:%d p:%d cmd:%d table:%d rev:%d len:%d magic:%x\n",
477 sh.sm_num, sh.sm_v, sh.sm_p, sh.sm_cmd,
478 sh.sm_table, sh.sm_rev, sh.sm_len,
481 if (sh.sm_magic != SYNHDRMAGIC) {
482 if (softs->ipf_sync_debug > 2)
483 printf("uiomove(header) invalid %s\n",
489 if (sh.sm_v != 4 && sh.sm_v != 6) {
490 if (softs->ipf_sync_debug > 2)
491 printf("uiomove(header) invalid %s\n",
497 if (sh.sm_cmd > SMC_MAXCMD) {
498 if (softs->ipf_sync_debug > 2)
499 printf("uiomove(header) invalid %s\n",
506 if (sh.sm_table > SMC_MAXTBL) {
507 if (softs->ipf_sync_debug > 2)
508 printf("uiomove(header) invalid %s\n",
515 /* unsufficient data, wait until next call */
516 if (softs->ipf_sync_debug > 2)
517 printf("uiomove(header) insufficient data");
524 * We have a header, so try to read the amount of data
525 * needed for the request
529 if (sh.sm_len == 0) {
530 if (softs->ipf_sync_debug > 2)
531 printf("uiomove(data zero length %s\n",
537 if (uio->uio_resid >= sh.sm_len) {
539 err = UIOMOVE(data, sh.sm_len, UIO_WRITE, uio);
542 if (softs->ipf_sync_debug > 2)
543 printf("uiomove(data) failed: %d\n",
548 if (softs->ipf_sync_debug > 7)
549 printf("uiomove(data) %d bytes read\n",
552 if (sh.sm_table == SMC_STATE)
553 err = ipf_sync_state(softc, &sh, data);
554 else if (sh.sm_table == SMC_NAT)
555 err = ipf_sync_nat(softc, &sh, data);
556 if (softs->ipf_sync_debug > 7)
557 printf("[%d] Finished with error %d\n",
561 /* insufficient data, wait until next call */
562 if (softs->ipf_sync_debug > 2)
563 printf("uiomove(data) %s %d bytes, got %d\n",
564 "insufficient data, need",
565 sh.sm_len, (int)uio->uio_resid);
576 /* ------------------------------------------------------------------------ */
577 /* Function: ipf_sync_read */
578 /* Returns: int - 0 == success, else error value. */
579 /* Parameters: uio(O) - pointer to information about where to store data */
581 /* This function is called when a user program wants to read some data */
582 /* for pending state/NAT updates. If no data is available, the caller is */
583 /* put to sleep, pending a wakeup from the "lower half" of this code. */
584 /* ------------------------------------------------------------------------ */
586 ipf_sync_read(softc, uio)
587 ipf_main_softc_t *softc;
590 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
595 if ((uio->uio_resid & 3) || (uio->uio_resid < 8)) {
600 # if BSD_GE_YEAR(199306) || defined(__FreeBSD__) || defined(__osf__)
601 uio->uio_rw = UIO_READ;
604 MUTEX_ENTER(&softs->ipsl_mutex);
605 while ((softs->sl_tail == softs->sl_idx) &&
606 (softs->su_tail == softs->su_idx)) {
607 # if defined(_KERNEL)
609 if (!cv_wait_sig(&softs->ipslwait, &softs->ipsl_mutex.ipf_lk)) {
610 MUTEX_EXIT(&softs->ipsl_mutex);
619 l = get_sleep_lock(&softs->sl_tail);
620 err = sleep(&softs->sl_tail, PZERO+1);
622 MUTEX_EXIT(&softs->ipsl_mutex);
630 err = mpsleep(&softs->sl_tail, PSUSP|PCATCH, "ipl sleep", 0,
631 &softs->ipsl_mutex, MS_LOCK_SIMPLE);
637 MUTEX_EXIT(&softs->ipsl_mutex);
638 err = SLEEP(&softs->sl_tail, "ipl sleep");
643 MUTEX_ENTER(&softs->ipsl_mutex);
644 # endif /* __osf__ */
646 # endif /* SOLARIS */
647 # endif /* _KERNEL */
650 while ((softs->sl_tail < softs->sl_idx) &&
651 (uio->uio_resid > sizeof(*sl))) {
652 sl = softs->synclog + softs->sl_tail++;
653 MUTEX_EXIT(&softs->ipsl_mutex);
654 err = UIOMOVE(sl, sizeof(*sl), UIO_READ, uio);
657 MUTEX_ENTER(&softs->ipsl_mutex);
660 while ((softs->su_tail < softs->su_idx) &&
661 (uio->uio_resid > sizeof(*su))) {
662 su = softs->syncupd + softs->su_tail;
664 MUTEX_EXIT(&softs->ipsl_mutex);
665 err = UIOMOVE(su, sizeof(*su), UIO_READ, uio);
668 MUTEX_ENTER(&softs->ipsl_mutex);
669 if (su->sup_hdr.sm_sl != NULL)
670 su->sup_hdr.sm_sl->sl_idx = -1;
672 if (softs->sl_tail == softs->sl_idx)
673 softs->sl_tail = softs->sl_idx = 0;
674 if (softs->su_tail == softs->su_idx)
675 softs->su_tail = softs->su_idx = 0;
676 MUTEX_EXIT(&softs->ipsl_mutex);
682 /* ------------------------------------------------------------------------ */
683 /* Function: ipf_sync_state */
684 /* Returns: int - 0 == success, else error value. */
685 /* Parameters: sp(I) - pointer to sync packet data header */
686 /* uio(I) - pointer to user data for further information */
688 /* Updates the state table according to information passed in the sync */
689 /* header. As required, more data is fetched from the uio structure but */
690 /* varies depending on the contents of the sync header. This function can */
691 /* create a new state entry or update one. Deletion is left to the state */
692 /* structures being timed out correctly. */
693 /* ------------------------------------------------------------------------ */
695 ipf_sync_state(softc, sp, data)
696 ipf_main_softc_t *softc;
700 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
708 hv = sp->sm_num & (softs->ipf_sync_state_tab_sz - 1);
714 bcopy(data, &sn, sizeof(sn));
715 KMALLOC(is, ipstate_t *);
722 KMALLOC(sl, synclist_t *);
730 bzero((char *)is, offsetof(ipstate_t, is_die));
731 bcopy((char *)&sn.is_die, (char *)&is->is_die,
732 sizeof(*is) - offsetof(ipstate_t, is_die));
733 ipf_sync_storder(0, is);
736 * We need to find the same rule on the slave as was used on
737 * the master to create this state entry.
739 READ_ENTER(&softc->ipf_mutex);
740 fr = ipf_getrulen(softc, IPL_LOGIPF, sn.is_group, sn.is_rulen);
742 MUTEX_ENTER(&fr->fr_lock);
745 MUTEX_EXIT(&fr->fr_lock);
747 RWLOCK_EXIT(&softc->ipf_mutex);
749 if (softs->ipf_sync_debug > 4)
750 printf("[%d] Filter rules = %p\n", sp->sm_num, fr);
757 bcopy(sp, &sl->sl_hdr, sizeof(struct synchdr));
759 WRITE_ENTER(&softs->ipf_syncstate);
760 WRITE_ENTER(&softc->ipf_state);
762 sl->sl_pnext = softs->syncstatetab + hv;
763 sl->sl_next = softs->syncstatetab[hv];
764 if (softs->syncstatetab[hv] != NULL)
765 softs->syncstatetab[hv]->sl_pnext = &sl->sl_next;
766 softs->syncstatetab[hv] = sl;
767 MUTEX_DOWNGRADE(&softs->ipf_syncstate);
768 ipf_state_insert(softc, is, sp->sm_rev);
770 * Do not initialise the interface pointers for the state
771 * entry as the full complement of interface names may not
774 * Put this state entry on its timeout queue.
776 /*fr_setstatequeue(is, sp->sm_rev);*/
780 bcopy(data, &su, sizeof(su));
782 if (softs->ipf_sync_debug > 4)
783 printf("[%d] Update age %lu state %d/%d \n",
784 sp->sm_num, su.stu_age, su.stu_state[0],
787 READ_ENTER(&softs->ipf_syncstate);
788 for (sl = softs->syncstatetab[hv]; (sl != NULL);
790 if (sl->sl_hdr.sm_num == sp->sm_num)
793 if (softs->ipf_sync_debug > 1)
794 printf("[%d] State not found - can't update\n",
796 RWLOCK_EXIT(&softs->ipf_syncstate);
802 READ_ENTER(&softc->ipf_state);
804 if (softs->ipf_sync_debug > 6)
805 printf("[%d] Data from state v:%d p:%d cmd:%d table:%d rev:%d\n",
806 sp->sm_num, sl->sl_hdr.sm_v, sl->sl_hdr.sm_p,
807 sl->sl_hdr.sm_cmd, sl->sl_hdr.sm_table,
812 MUTEX_ENTER(&is->is_lock);
816 /* XXX FV --- shouldn't we do ntohl/htonl???? XXX */
817 is->is_send = su.stu_data[0].td_end;
818 is->is_maxsend = su.stu_data[0].td_maxend;
819 is->is_maxswin = su.stu_data[0].td_maxwin;
820 is->is_state[0] = su.stu_state[0];
821 is->is_dend = su.stu_data[1].td_end;
822 is->is_maxdend = su.stu_data[1].td_maxend;
823 is->is_maxdwin = su.stu_data[1].td_maxwin;
824 is->is_state[1] = su.stu_state[1];
830 if (softs->ipf_sync_debug > 6)
831 printf("[%d] Setting timers for state\n", sp->sm_num);
833 ipf_state_setqueue(softc, is, sp->sm_rev);
835 MUTEX_EXIT(&is->is_lock);
845 RWLOCK_EXIT(&softc->ipf_state);
846 RWLOCK_EXIT(&softs->ipf_syncstate);
849 if (softs->ipf_sync_debug > 6)
850 printf("[%d] Update completed with error %d\n",
857 /* ------------------------------------------------------------------------ */
858 /* Function: ipf_sync_del */
860 /* Parameters: sl(I) - pointer to synclist object to delete */
862 /* Deletes an object from the synclist. */
863 /* ------------------------------------------------------------------------ */
865 ipf_sync_del(softs, sl)
866 ipf_sync_softc_t *softs;
869 *sl->sl_pnext = sl->sl_next;
870 if (sl->sl_next != NULL)
871 sl->sl_next->sl_pnext = sl->sl_pnext;
872 if (sl->sl_idx != -1)
873 softs->syncupd[sl->sl_idx].sup_hdr.sm_sl = NULL;
877 /* ------------------------------------------------------------------------ */
878 /* Function: ipf_sync_del_state */
880 /* Parameters: sl(I) - pointer to synclist object to delete */
882 /* Deletes an object from the synclist state table and free's its memory. */
883 /* ------------------------------------------------------------------------ */
885 ipf_sync_del_state(arg, sl)
889 ipf_sync_softc_t *softs = arg;
891 WRITE_ENTER(&softs->ipf_syncstate);
892 ipf_sync_del(softs, sl);
893 RWLOCK_EXIT(&softs->ipf_syncstate);
898 /* ------------------------------------------------------------------------ */
899 /* Function: ipf_sync_del_nat */
901 /* Parameters: sl(I) - pointer to synclist object to delete */
903 /* Deletes an object from the synclist nat table and free's its memory. */
904 /* ------------------------------------------------------------------------ */
906 ipf_sync_del_nat(arg, sl)
910 ipf_sync_softc_t *softs = arg;
912 WRITE_ENTER(&softs->ipf_syncnat);
913 ipf_sync_del(softs, sl);
914 RWLOCK_EXIT(&softs->ipf_syncnat);
919 /* ------------------------------------------------------------------------ */
920 /* Function: ipf_sync_nat */
921 /* Returns: int - 0 == success, else error value. */
922 /* Parameters: sp(I) - pointer to sync packet data header */
923 /* uio(I) - pointer to user data for further information */
925 /* Updates the NAT table according to information passed in the sync */
926 /* header. As required, more data is fetched from the uio structure but */
927 /* varies depending on the contents of the sync header. This function can */
928 /* create a new NAT entry or update one. Deletion is left to the NAT */
929 /* structures being timed out correctly. */
930 /* ------------------------------------------------------------------------ */
932 ipf_sync_nat(softc, sp, data)
933 ipf_main_softc_t *softc;
937 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
944 READ_ENTER(&softs->ipf_syncnat);
956 KMALLOC(sl, synclist_t *);
965 bzero((char *)n, offsetof(nat_t, nat_age));
966 bcopy((char *)&nat->nat_age, (char *)&n->nat_age,
967 sizeof(*n) - offsetof(nat_t, nat_age));
968 ipf_sync_natorder(0, n);
970 n->nat_rev = sl->sl_rev;
974 sl->sl_num = ntohl(sp->sm_num);
976 WRITE_ENTER(&softc->ipf_nat);
977 sl->sl_pnext = softs->syncnattab + hv;
978 sl->sl_next = softs->syncnattab[hv];
979 if (softs->syncnattab[hv] != NULL)
980 softs->syncnattab[hv]->sl_pnext = &sl->sl_next;
981 softs->syncnattab[hv] = sl;
982 (void) ipf_nat_insert(softc, softc->ipf_nat_soft, n);
983 RWLOCK_EXIT(&softc->ipf_nat);
987 bcopy(data, &su, sizeof(su));
989 for (sl = softs->syncnattab[hv]; (sl != NULL);
991 if (sl->sl_hdr.sm_num == sp->sm_num)
999 READ_ENTER(&softc->ipf_nat);
1002 nat->nat_rev = sl->sl_rev;
1004 MUTEX_ENTER(&nat->nat_lock);
1005 ipf_nat_setqueue(softc, softc->ipf_nat_soft, nat);
1006 MUTEX_EXIT(&nat->nat_lock);
1008 RWLOCK_EXIT(&softc->ipf_nat);
1018 RWLOCK_EXIT(&softs->ipf_syncnat);
1023 /* ------------------------------------------------------------------------ */
1024 /* Function: ipf_sync_new */
1025 /* Returns: synclist_t* - NULL == failure, else pointer to new synclist */
1026 /* data structure. */
1027 /* Parameters: tab(I) - type of synclist_t to create */
1028 /* fin(I) - pointer to packet information */
1029 /* ptr(I) - pointer to owning object */
1031 /* Creates a new sync table entry and notifies any sleepers that it's there */
1032 /* waiting to be processed. */
1033 /* ------------------------------------------------------------------------ */
1035 ipf_sync_new(softc, tab, fin, ptr)
1036 ipf_main_softc_t *softc;
1041 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1042 synclist_t *sl, *ss;
1046 if (softs->sl_idx == softs->ipf_sync_log_sz)
1048 KMALLOC(sl, synclist_t *);
1052 MUTEX_ENTER(&softs->ipf_syncadd);
1054 * Get a unique number for this synclist_t. The number is only meant
1055 * to be unique for the lifetime of the structure and may be reused
1058 softs->ipf_sync_num++;
1059 if (softs->ipf_sync_num == 0) {
1060 softs->ipf_sync_num = 1;
1061 softs->ipf_sync_wrap++;
1065 * Use the synch number of the object as the hash key. Should end up
1066 * with relatively even distribution over time.
1067 * XXX - an attacker could lunch an DoS attack, of sorts, if they are
1068 * the only one causing new table entries by only keeping open every
1069 * nth connection they make, where n is a value in the interval
1070 * [0, SYNC_STATETABSZ-1].
1075 hv = softs->ipf_sync_num & (softs->ipf_sync_state_tab_sz - 1);
1076 while (softs->ipf_sync_wrap != 0) {
1077 for (ss = softs->syncstatetab[hv]; ss; ss = ss->sl_next)
1078 if (ss->sl_hdr.sm_num == softs->ipf_sync_num)
1082 softs->ipf_sync_num++;
1083 hv = softs->ipf_sync_num &
1084 (softs->ipf_sync_state_tab_sz - 1);
1086 sl->sl_pnext = softs->syncstatetab + hv;
1087 sl->sl_next = softs->syncstatetab[hv];
1088 softs->syncstatetab[hv] = sl;
1092 hv = softs->ipf_sync_num & (softs->ipf_sync_nat_tab_sz - 1);
1093 while (softs->ipf_sync_wrap != 0) {
1094 for (ss = softs->syncnattab[hv]; ss; ss = ss->sl_next)
1095 if (ss->sl_hdr.sm_num == softs->ipf_sync_num)
1099 softs->ipf_sync_num++;
1100 hv = softs->ipf_sync_num &
1101 (softs->ipf_sync_nat_tab_sz - 1);
1103 sl->sl_pnext = softs->syncnattab + hv;
1104 sl->sl_next = softs->syncnattab[hv];
1105 softs->syncnattab[hv] = sl;
1112 sl->sl_num = softs->ipf_sync_num;
1113 MUTEX_EXIT(&softs->ipf_syncadd);
1115 sl->sl_magic = htonl(SYNHDRMAGIC);
1116 sl->sl_v = fin->fin_v;
1117 sl->sl_p = fin->fin_p;
1118 sl->sl_cmd = SMC_CREATE;
1121 sl->sl_rev = fin->fin_rev;
1122 if (tab == SMC_STATE) {
1124 sz = sizeof(*sl->sl_ips);
1125 } else if (tab == SMC_NAT) {
1127 sz = sizeof(*sl->sl_ipn);
1135 * Create the log entry to be read by a user daemon. When it has been
1136 * finished and put on the queue, send a signal to wakeup any waiters.
1138 MUTEX_ENTER(&softs->ipf_syncadd);
1139 sle = softs->synclog + softs->sl_idx++;
1140 bcopy((char *)&sl->sl_hdr, (char *)&sle->sle_hdr,
1141 sizeof(sle->sle_hdr));
1142 sle->sle_hdr.sm_num = htonl(sle->sle_hdr.sm_num);
1143 sle->sle_hdr.sm_len = htonl(sle->sle_hdr.sm_len);
1145 bcopy((char *)ptr, (char *)&sle->sle_un, sz);
1146 if (tab == SMC_STATE) {
1147 ipf_sync_storder(1, &sle->sle_un.sleu_ips);
1148 } else if (tab == SMC_NAT) {
1149 ipf_sync_natorder(1, &sle->sle_un.sleu_ipn);
1152 MUTEX_EXIT(&softs->ipf_syncadd);
1154 ipf_sync_wakeup(softc);
1159 /* ------------------------------------------------------------------------ */
1160 /* Function: ipf_sync_update */
1162 /* Parameters: tab(I) - type of synclist_t to create */
1163 /* fin(I) - pointer to packet information */
1164 /* sl(I) - pointer to synchronisation object */
1166 /* For outbound packets, only, create an sync update record for the user */
1167 /* process to read. */
1168 /* ------------------------------------------------------------------------ */
1170 ipf_sync_update(softc, tab, fin, sl)
1171 ipf_main_softc_t *softc;
1176 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1177 synctcp_update_t *st;
1183 if (fin->fin_out == 0 || sl == NULL)
1186 if (tab == SMC_STATE) {
1187 lock = &softs->ipf_syncstate;
1189 lock = &softs->ipf_syncnat;
1193 if (sl->sl_idx == -1) {
1194 MUTEX_ENTER(&softs->ipf_syncadd);
1195 slu = softs->syncupd + softs->su_idx;
1196 sl->sl_idx = softs->su_idx++;
1197 MUTEX_EXIT(&softs->ipf_syncadd);
1199 bcopy((char *)&sl->sl_hdr, (char *)&slu->sup_hdr,
1200 sizeof(slu->sup_hdr));
1201 slu->sup_hdr.sm_magic = htonl(SYNHDRMAGIC);
1202 slu->sup_hdr.sm_sl = sl;
1203 slu->sup_hdr.sm_cmd = SMC_UPDATE;
1204 slu->sup_hdr.sm_table = tab;
1205 slu->sup_hdr.sm_num = htonl(sl->sl_num);
1206 slu->sup_hdr.sm_len = htonl(sizeof(struct synctcp_update));
1207 slu->sup_hdr.sm_rev = fin->fin_rev;
1209 if (fin->fin_p == IPPROTO_TCP) {
1215 slu = softs->syncupd + sl->sl_idx;
1218 * Only TCP has complex timeouts, others just use default timeouts.
1219 * For TCP, we only need to track the connection state and window.
1221 if (fin->fin_p == IPPROTO_TCP) {
1223 if (tab == SMC_STATE) {
1225 st->stu_age = htonl(ips->is_die);
1226 st->stu_data[0].td_end = ips->is_send;
1227 st->stu_data[0].td_maxend = ips->is_maxsend;
1228 st->stu_data[0].td_maxwin = ips->is_maxswin;
1229 st->stu_state[0] = ips->is_state[0];
1230 st->stu_data[1].td_end = ips->is_dend;
1231 st->stu_data[1].td_maxend = ips->is_maxdend;
1232 st->stu_data[1].td_maxwin = ips->is_maxdwin;
1233 st->stu_state[1] = ips->is_state[1];
1234 } else if (tab == SMC_NAT) {
1236 st->stu_age = htonl(nat->nat_age);
1241 ipf_sync_wakeup(softc);
1245 /* ------------------------------------------------------------------------ */
1246 /* Function: ipf_sync_flush_table */
1247 /* Returns: int - number of entries freed by flushing table */
1248 /* Parameters: tabsize(I) - size of the array pointed to by table */
1249 /* table(I) - pointer to sync table to empty */
1251 /* Walk through a table of sync entries and free each one. It is assumed */
1252 /* that some lock is held so that nobody else tries to access the table */
1253 /* during this cleanup. */
1254 /* ------------------------------------------------------------------------ */
1256 ipf_sync_flush_table(softs, tabsize, table)
1257 ipf_sync_softc_t *softs;
1266 for (i = 0; i < tabsize; i++) {
1267 while ((sl = table[i]) != NULL) {
1268 switch (sl->sl_table) {
1270 if (sl->sl_ips != NULL)
1271 sl->sl_ips->is_sync = NULL;
1274 if (sl->sl_ipn != NULL)
1275 sl->sl_ipn->nat_sync = NULL;
1278 if (sl->sl_next != NULL)
1279 sl->sl_next->sl_pnext = sl->sl_pnext;
1280 table[i] = sl->sl_next;
1281 if (sl->sl_idx != -1)
1282 softs->syncupd[sl->sl_idx].sup_hdr.sm_sl = NULL;
1292 /* ------------------------------------------------------------------------ */
1293 /* Function: ipf_sync_ioctl */
1294 /* Returns: int - 0 == success, != 0 == failure */
1295 /* Parameters: data(I) - pointer to ioctl data */
1296 /* cmd(I) - ioctl command integer */
1297 /* mode(I) - file mode bits used with open */
1299 /* This function currently does not handle any ioctls and so just returns */
1300 /* EINVAL on all occasions. */
1301 /* ------------------------------------------------------------------------ */
1303 ipf_sync_ioctl(softc, data, cmd, mode, uid, ctx)
1304 ipf_main_softc_t *softc;
1310 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1317 error = BCOPYIN(data, &i, sizeof(i));
1328 MUTEX_ENTER(&softs->ipsl_mutex);
1329 i = (softs->sl_tail - softs->sl_idx) +
1330 (softs->su_tail - softs->su_idx);
1335 MUTEX_EXIT(&softs->ipsl_mutex);
1341 WRITE_ENTER(&softs->ipf_syncnat);
1342 i = ipf_sync_flush_table(softs, SYNC_NATTABSZ,
1344 RWLOCK_EXIT(&softs->ipf_syncnat);
1350 WRITE_ENTER(&softs->ipf_syncstate);
1351 i = ipf_sync_flush_table(softs, SYNC_STATETABSZ,
1352 softs->syncstatetab);
1353 RWLOCK_EXIT(&softs->ipf_syncstate);
1358 error = BCOPYOUT(&i, data, sizeof(i));
1375 /* ------------------------------------------------------------------------ */
1376 /* Function: ipf_sync_canread */
1377 /* Returns: int - 0 == success, != 0 == failure */
1378 /* Parameters: Nil */
1380 /* This function provides input to the poll handler about whether or not */
1381 /* there is data waiting to be read from the /dev/ipsync device. */
1382 /* ------------------------------------------------------------------------ */
1384 ipf_sync_canread(arg)
1387 ipf_sync_softc_t *softs = arg;
1388 return !((softs->sl_tail == softs->sl_idx) &&
1389 (softs->su_tail == softs->su_idx));
1393 /* ------------------------------------------------------------------------ */
1394 /* Function: ipf_sync_canwrite */
1395 /* Returns: int - 1 == can always write */
1396 /* Parameters: Nil */
1398 /* This function lets the poll handler know that it is always ready willing */
1399 /* to accept write events. */
1400 /* XXX Maybe this should return false if the sync table is full? */
1401 /* ------------------------------------------------------------------------ */
1403 ipf_sync_canwrite(arg)
1410 /* ------------------------------------------------------------------------ */
1411 /* Function: ipf_sync_wakeup */
1412 /* Parameters: Nil */
1415 /* This function implements the heuristics that decide how often to */
1416 /* generate a poll wakeup for programs that are waiting for information */
1417 /* about when they can do a read on /dev/ipsync. */
1419 /* There are three different considerations here: */
1420 /* - do not keep a program waiting too long: ipf_sync_wake_interval is the */
1421 /* maximum number of ipf ticks to let pass by; */
1422 /* - do not let the queue of ouststanding things to generate notifies for */
1423 /* get too full (ipf_sync_queue_high_wm is the high water mark); */
1424 /* - do not let too many events get collapsed in before deciding that the */
1425 /* other host(s) need an update (ipf_sync_event_high_wm is the high water */
1426 /* mark for this counter.) */
1427 /* ------------------------------------------------------------------------ */
1429 ipf_sync_wakeup(softc)
1430 ipf_main_softc_t *softc;
1432 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1434 softs->ipf_sync_events++;
1435 if ((softc->ipf_ticks >
1436 softs->ipf_sync_lastwakeup + softs->ipf_sync_wake_interval) ||
1437 (softs->ipf_sync_events > softs->ipf_sync_event_high_wm) ||
1438 ((softs->sl_tail - softs->sl_idx) >
1439 softs->ipf_sync_queue_high_wm) ||
1440 ((softs->su_tail - softs->su_idx) >
1441 softs->ipf_sync_queue_high_wm)) {
1443 ipf_sync_poll_wakeup(softc);
1448 /* ------------------------------------------------------------------------ */
1449 /* Function: ipf_sync_poll_wakeup */
1450 /* Parameters: Nil */
1453 /* Deliver a poll wakeup and reset counters for two of the three heuristics */
1454 /* ------------------------------------------------------------------------ */
1456 ipf_sync_poll_wakeup(softc)
1457 ipf_main_softc_t *softc;
1459 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1461 softs->ipf_sync_events = 0;
1462 softs->ipf_sync_lastwakeup = softc->ipf_ticks;
1466 MUTEX_ENTER(&softs->ipsl_mutex);
1467 cv_signal(&softs->ipslwait);
1468 MUTEX_EXIT(&softs->ipsl_mutex);
1469 pollwakeup(&softc->ipf_poll_head[IPL_LOGSYNC], POLLIN|POLLRDNORM);
1471 WAKEUP(&softs->sl_tail, 0);
1472 POLLWAKEUP(IPL_LOGSYNC);
1478 /* ------------------------------------------------------------------------ */
1479 /* Function: ipf_sync_expire */
1480 /* Parameters: Nil */
1483 /* This is the function called even ipf_tick. It implements one of the */
1484 /* three heuristics above *IF* there are events waiting. */
1485 /* ------------------------------------------------------------------------ */
1487 ipf_sync_expire(softc)
1488 ipf_main_softc_t *softc;
1490 ipf_sync_softc_t *softs = softc->ipf_sync_soft;
1492 if ((softs->ipf_sync_events > 0) &&
1494 softs->ipf_sync_lastwakeup + softs->ipf_sync_wake_interval)) {
1495 ipf_sync_poll_wakeup(softc);