pfsync code is called for every new state, state update and state
deletion in pf. While pf itself can operate on multiple states at the
same time (on different cores, assuming the states hash to a different
hashrow), pfsync only had a single lock.
This greatly reduced throughput on multicore systems.
Address this by enqueuing updates, rather than executing them
immediately. Using the lockless ck_ring messages can be created and
enqueued without blocking other threads.
These are then handled in a software interrupt, performing the same
operations as before.
States are references as they're enqueued, so they cannot be cleared
until they've been processed by pfsync.
If pfsync cannot allocate or enqueue a new message it will tell pf to
drop the packet, ensuring that state updates are not lost.
The ring size can be tuned through 'net.pfsync.pfsync_max_msgs'. Note
that the value will always be rounded to a power of two.
Sponsored by: Orange Business Services