Details

Reviewers

Commits

rG4bf98559d9d6: pf: make contents of struct pfsync_state configurable

Summary

This patch makes struct pfsync_state contents configurable by sending out new versions of the structure in separate subheader actions. Both old and new version of struct pfsync_state can be understood, so replication of states from a system running an older kernel is possible. The version being sent out is configured using ifconfig pfsync0 … version XXXX. The version is an user-friendly string - 1301 stands for FreeBSD 13.1 (I have checked synchronization against a host running 13.1), 1400 stands for 14.0. A host running an older kernel will just ignore the messages and count them as "packets discarded for bad action".

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

vegeta_tuxpowered.net created this revision.Apr 2 2023, 9:05 PM

Herald added subscribers: glebius, melifaro, farrokhi and 2 others. · View Herald TranscriptApr 2 2023, 9:05 PM

Remove debug printfs

vegeta_tuxpowered.net added inline comments.Apr 2 2023, 9:20 PM

sys/net/if_pfsync.h
59	Please note that I've decided to not change the protocol version. Making the code work with messages from older peer would not be as easy as it is with subheaders.
sys/net/pfvar.h
1171	Please don't treat this version of structure as final yet, I am not 100% sure how will it play with D38025.
sys/netpfil/pf/if_pfsync.c
153	State deletions are sent out using `pfsync_out_del` which sends out `struct pfsync_del_c` containing only creator id and state id. The actions are queued in `PFSYNC_Q_DEL`. The receiving functions for those is `pfsync_in_del_c`. It seems that `pfsync_in_del` is never used. Should we remove it? And clean up queue and function names to `_c`?

vegeta_tuxpowered.net added inline comments.Apr 3 2023, 8:10 AM

sys/net/if_pfsync.h
65	A new version would be introduced only when compatibility is broken. In theory the 1301 version could be renamed to something lower. As far as my own experience with FreeBSD goes it could be probably 10.0. But I have tested it only with a 13.1 peer, so let's keep this as the initial value.

I'll get to a more in-depth look at this when I'm back from AsiaBSD.

sys/net/pfvar.h
1171	I'm fine with breaking the protocol compatibility within 14 until we release 14.0 anyway. I mean, we shouldn't go out of our way to break it, but we're not going to install compatibility hacks for changes within main prior to a release either.
sys/netpfil/pf/if_pfsync.c
153	It seems so. I'll try to do a bit of a dive in the history later, but it seems like this might be for compatibility with some older version, in which case it's probably old enough we can just delete it.

guest-patmaddox added a subscriber: guest-patmaddox.Apr 3 2023, 2:41 PM

vegeta_tuxpowered.net mentioned this in D38025: Backport OpenBSD syntax of "scrub" option for "match" and "pass" rules.Apr 3 2023, 9:02 PM

vegeta_tuxpowered.net edited the summary of this revision. (Show Details)Apr 4 2023, 4:45 PM

Added function pfsync_sstate_to_qid to translates pf_kstate->sync_state to queue name. This removes multiple such translations scattered around the code and fixes pfsync_q_del.

Removed PFSYNC_ACT_DEL and ensured that other deletion functions and constants are named with _c suffix as this seems to be the convention for code operating only on state id.

Removed pfsync_state_1301->state_flags_compat and restored the 8-bit state_flags. That leaves pfsync as broken as it was for FreeBSD 13.1 compatibility. Since this patch provides a way to switch to a new pfsync data structure such tricks should not be needed. The 8+16-bit state_flags trick is kept on struct pf_state_export, though as for this structure no versioning is possible but a lot of spare space is available.

vegeta_tuxpowered.net added inline comments.May 5 2023, 5:48 PM

sys/netpfil/pf/if_pfsync.c
153	Do you want me to split the `pf_sync_in_del` change into a separate review?

kp added inline comments.May 5 2023, 6:03 PM

sys/netpfil/pf/if_pfsync.c
153	Yeah, that seems like w good idea. Sorry I haven’t gotten around to this one yet. It’s on my list, but you may be familiar with the ever growing nature of todo lists.

kp added inline comments.May 8 2023, 9:08 AM

sys/net/pfvar.h
783	I'd separate this as its own commit as well.
1006	Extending the state information passed to userspace probably belongs in a separate commit as well.
sys/netpfil/pf/if_pfsync.c
153	I did a little bit of digging, and I think that sending of PFSYNC_ACT_DEL was retired in OpenBSD in this commit: commit c62efabc0a1b17d5fbc801b77749f7b4b8b7049b Author: dlg <dlg@openbsd.org> Date: Mon Feb 16 00:31:25 2009 +0000 pfsync v5, mostly written at n2k9, but based on work done at n2k8. WARNING: THIS BREAKS COMPATIBILITY WITH THE PREVIOUS VERSION OF PFSYNC this is a new variant of the protocol and a large reworking of the pfsync code to address some performance issues. the single largest benefit comes from having multiple pfsync messages of different types handled in a single packet. pfsyncs handling of pf states is highly optimised now, along with packet parsing and construction. huggz for beck@ for testing. huge thanks to mcbride@ for his help during development and for finding all the bugs during the initial tests. thanks to peter sutton for letting me get credit for this work. ok beck@ mcbride@ "good." deraadt@ So I'm inclined to say we can indeed just get rid of support for it entirely.
2210	I'd `default:` this, because if we add a new version that doesn't affect PFSYNC_S_INS we'd have to add another case here (or change it to default).

vegeta_tuxpowered.net marked 2 inline comments as done.May 8 2023, 8:49 PM

vegeta_tuxpowered.net added inline comments.

sys/net/pfvar.h
783	Moved into D40013
sys/netpfil/pf/if_pfsync.c
153	Moved into D40004.

Rebased on D40004 and D40013 as separate commits.

Rebased again, the previous diff has been wrongly generated.

Fixed broken rebase on main.

Split userspace export into a separate commit for DIOCGETSTATESV2.

Added tcpdump and netstat changes to this patch because of change of struct pfsync_state to struct pfsync_state_1301.

vegeta_tuxpowered.net marked 2 inline comments as done.May 24 2023, 9:22 PM

vegeta_tuxpowered.net mentioned this in D40259: pfctl: Add missing state parameters in DIOCGETSTATESV2.May 28 2023, 1:03 PM

I've changed the title line of the commit message, so I expect the hooks won't pick up that this landed. Can you close/abandon this review?

This revision was not accepted when it landed; it landed in state Needs Review.May 30 2023, 12:30 PM

Closed by commit rG4bf98559d9d6: pf: make contents of struct pfsync_state configurable (authored by vegeta_tuxpowered.net, committed by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rG4bf98559d9d6: pf: make contents of struct pfsync_state configurable.

guest-patmaddox removed a subscriber: guest-patmaddox.Jul 29 2023, 5:39 AM

Diff 122383

View Options

contrib/tcpdump/print-pfsync.c

Show First 20 Lines • Show All 49 Lines • ▼ Show 20 Lines
#include "interface.h"		#include "interface.h"
#include "addrtoname.h"		#include "addrtoname.h"

static void pfsync_print(netdissect_options , struct pfsync_header ,		static void pfsync_print(netdissect_options , struct pfsync_header ,
const u_char *, u_int);		const u_char *, u_int);
static void print_src_dst(netdissect_options *,		static void print_src_dst(netdissect_options *,
const struct pfsync_state_peer *,		const struct pfsync_state_peer *,
const struct pfsync_state_peer *, uint8_t);		const struct pfsync_state_peer *, uint8_t);
static void print_state(netdissect_options , struct pfsync_state );		static void print_state(netdissect_options , union pfsync_state_union , int);

u_int		u_int
pfsync_if_print(netdissect_options ndo, const struct pcap_pkthdr h,		pfsync_if_print(netdissect_options ndo, const struct pcap_pkthdr h,
register const u_char *p)		register const u_char *p)
{		{
u_int caplen = h->caplen;		u_int caplen = h->caplen;

ts_print(ndo, &h->ts);		ts_print(ndo, &h->ts);
Show All 28 Lines

struct pfsync_actions {		struct pfsync_actions {
const char *name;		const char *name;
size_t len;		size_t len;
void (print)(netdissect_options , const void *);		void (print)(netdissect_options , const void *);
};		};

static void pfsync_print_clr(netdissect_options , const void );		static void pfsync_print_clr(netdissect_options , const void );
static void pfsync_print_state(netdissect_options , const void );		static void pfsync_print_state_1301(netdissect_options , const void );
		static void pfsync_print_state_1400(netdissect_options , const void );
static void pfsync_print_ins_ack(netdissect_options , const void );		static void pfsync_print_ins_ack(netdissect_options , const void );
static void pfsync_print_upd_c(netdissect_options , const void );		static void pfsync_print_upd_c(netdissect_options , const void );
static void pfsync_print_upd_req(netdissect_options , const void );		static void pfsync_print_upd_req(netdissect_options , const void );
static void pfsync_print_del_c(netdissect_options , const void );		static void pfsync_print_del_c(netdissect_options , const void );
static void pfsync_print_bus(netdissect_options , const void );		static void pfsync_print_bus(netdissect_options , const void );
static void pfsync_print_tdb(netdissect_options , const void );		static void pfsync_print_tdb(netdissect_options , const void );

struct pfsync_actions actions[] = {		struct pfsync_actions actions[] = {
{ "clear all", sizeof(struct pfsync_clr), pfsync_print_clr },		{ "clear all", sizeof(struct pfsync_clr), pfsync_print_clr },
{ "insert", sizeof(struct pfsync_state), pfsync_print_state },		{ "insert 13.1", sizeof(struct pfsync_state_1301),
		pfsync_print_state_1301 },
{ "insert ack", sizeof(struct pfsync_ins_ack), pfsync_print_ins_ack },		{ "insert ack", sizeof(struct pfsync_ins_ack), pfsync_print_ins_ack },
{ "update", sizeof(struct pfsync_ins_ack), pfsync_print_state },		{ "update 13.1", sizeof(struct pfsync_state_1301),
		pfsync_print_state_1301 },
{ "update compressed", sizeof(struct pfsync_upd_c),		{ "update compressed", sizeof(struct pfsync_upd_c),
pfsync_print_upd_c },		pfsync_print_upd_c },
{ "request uncompressed", sizeof(struct pfsync_upd_req),		{ "request uncompressed", sizeof(struct pfsync_upd_req),
pfsync_print_upd_req },		pfsync_print_upd_req },
{ "delete", sizeof(struct pfsync_state), pfsync_print_state },		{ "delete", sizeof(struct pfsync_state_1301), pfsync_print_state_1301 },
{ "delete compressed", sizeof(struct pfsync_del_c),		{ "delete compressed", sizeof(struct pfsync_del_c),
pfsync_print_del_c },		pfsync_print_del_c },
{ "frag insert", 0, NULL },		{ "frag insert", 0, NULL },
{ "frag delete", 0, NULL },		{ "frag delete", 0, NULL },
{ "bulk update status", sizeof(struct pfsync_bus),		{ "bulk update status", sizeof(struct pfsync_bus),
pfsync_print_bus },		pfsync_print_bus },
{ "tdb", 0, pfsync_print_tdb },		{ "tdb", 0, pfsync_print_tdb },
{ "eof", 0, NULL },		{ "eof", 0, NULL },
		{ "insert", sizeof(struct pfsync_state_1400), pfsync_print_state_1400 },
		{ "update", sizeof(struct pfsync_state_1400), pfsync_print_state_1400 },
};		};

static void		static void
pfsync_print(netdissect_options ndo, struct pfsync_header hdr,		pfsync_print(netdissect_options ndo, struct pfsync_header hdr,
const u_char *bp, u_int len)		const u_char *bp, u_int len)
{		{
struct pfsync_subheader *subh;		struct pfsync_subheader *subh;
int count, plen, i;		int count, plen, i;
▲ Show 20 Lines • Show All 70 Lines • ▼ Show 20 Lines	pfsync_print_clr(netdissect_options ndo, const void bp)
const struct pfsync_clr *clr = bp;		const struct pfsync_clr *clr = bp;

ND_PRINT((ndo, "\n\tcreatorid: %08x", htonl(clr->creatorid)));		ND_PRINT((ndo, "\n\tcreatorid: %08x", htonl(clr->creatorid)));
if (clr->ifname[0] != '\0')		if (clr->ifname[0] != '\0')
ND_PRINT((ndo, " interface: %s", clr->ifname));		ND_PRINT((ndo, " interface: %s", clr->ifname));
}		}

static void		static void
pfsync_print_state(netdissect_options ndo, const void bp)		pfsync_print_state_1301(netdissect_options ndo, const void bp)
{		{
struct pfsync_state st = (struct pfsync_state )bp;		struct pfsync_state_1301 st = (struct pfsync_state_1301 )bp;

safeputchar(ndo, '\n');		safeputchar(ndo, '\n');
print_state(ndo, st);		print_state(ndo, (union pfsync_state_union *)st, PFSYNC_MSG_VERSION_1301);
}		}

static void		static void
		pfsync_print_state_1400(netdissect_options ndo, const void bp)
		{
		struct pfsync_state_1301 st = (struct pfsync_state_1301 )bp;

		safeputchar(ndo, '\n');
		print_state(ndo, (union pfsync_state_union *)st, PFSYNC_MSG_VERSION_1400);
		}

		static void
pfsync_print_ins_ack(netdissect_options ndo, const void bp)		pfsync_print_ins_ack(netdissect_options ndo, const void bp)
{		{
const struct pfsync_ins_ack *iack = bp;		const struct pfsync_ins_ack *iack = bp;

ND_PRINT((ndo, "\n\tid: %016jx creatorid: %08x",		ND_PRINT((ndo, "\n\tid: %016jx creatorid: %08x",
(uintmax_t)be64toh(iack->id), ntohl(iack->creatorid)));		(uintmax_t)be64toh(iack->id), ntohl(iack->creatorid)));
}		}

▲ Show 20 Lines • Show All 137 Lines • ▼ Show 20 Lines	if (proto == IPPROTO_TCP) {

ND_PRINT((ndo, " %s:%s", states[src->state], states[dst->state]));		ND_PRINT((ndo, " %s:%s", states[src->state], states[dst->state]));
} else {		} else {
ND_PRINT((ndo, " %u:%u", src->state, dst->state));		ND_PRINT((ndo, " %u:%u", src->state, dst->state));
}		}
}		}

static void		static void
print_state(netdissect_options ndo, struct pfsync_state s)		print_state(netdissect_options ndo, union pfsync_state_union s, int version)
{		{
struct pfsync_state_peer src, dst;		struct pfsync_state_peer src, dst;
struct pfsync_state_key sk, nk;		struct pfsync_state_key sk, nk;
int min, sec;		int min, sec;

if (s->direction == PF_OUT) {		if (s->pfs_1301.direction == PF_OUT) {
src = &s->src;		src = &s->pfs_1301.src;
dst = &s->dst;		dst = &s->pfs_1301.dst;
sk = &s->key[PF_SK_STACK];		sk = &s->pfs_1301.key[PF_SK_STACK];
nk = &s->key[PF_SK_WIRE];		nk = &s->pfs_1301.key[PF_SK_WIRE];
if (s->proto == IPPROTO_ICMP \|\| s->proto == IPPROTO_ICMPV6)		if (s->pfs_1301.proto == IPPROTO_ICMP \|\| s->pfs_1301.proto == IPPROTO_ICMPV6)
sk->port[0] = nk->port[0];		sk->port[0] = nk->port[0];
} else {		} else {
src = &s->dst;		src = &s->pfs_1301.dst;
dst = &s->src;		dst = &s->pfs_1301.src;
sk = &s->key[PF_SK_WIRE];		sk = &s->pfs_1301.key[PF_SK_WIRE];
nk = &s->key[PF_SK_STACK];		nk = &s->pfs_1301.key[PF_SK_STACK];
if (s->proto == IPPROTO_ICMP \|\| s->proto == IPPROTO_ICMPV6)		if (s->pfs_1301.proto == IPPROTO_ICMP \|\| s->pfs_1301.proto == IPPROTO_ICMPV6)
sk->port[1] = nk->port[1];		sk->port[1] = nk->port[1];
}		}
ND_PRINT((ndo, "\t%s ", s->ifname));		ND_PRINT((ndo, "\t%s ", s->pfs_1301.ifname));
ND_PRINT((ndo, "proto %u ", s->proto));		ND_PRINT((ndo, "proto %u ", s->pfs_1301.proto));

print_host(ndo, &nk->addr[1], nk->port[1], s->af, NULL);		print_host(ndo, &nk->addr[1], nk->port[1], s->pfs_1301.af, NULL);
if (PF_ANEQ(&nk->addr[1], &sk->addr[1], s->af) \|\|		if (PF_ANEQ(&nk->addr[1], &sk->addr[1], s->pfs_1301.af) \|\|
nk->port[1] != sk->port[1]) {		nk->port[1] != sk->port[1]) {
ND_PRINT((ndo, " ("));		ND_PRINT((ndo, " ("));
print_host(ndo, &sk->addr[1], sk->port[1], s->af, NULL);		print_host(ndo, &sk->addr[1], sk->port[1], s->pfs_1301.af, NULL);
ND_PRINT((ndo, ")"));		ND_PRINT((ndo, ")"));
}		}
if (s->direction == PF_OUT)		if (s->pfs_1301.direction == PF_OUT)
ND_PRINT((ndo, " -> "));		ND_PRINT((ndo, " -> "));
else		else
ND_PRINT((ndo, " <- "));		ND_PRINT((ndo, " <- "));
print_host(ndo, &nk->addr[0], nk->port[0], s->af, NULL);		print_host(ndo, &nk->addr[0], nk->port[0], s->pfs_1301.af, NULL);
if (PF_ANEQ(&nk->addr[0], &sk->addr[0], s->af) \|\|		if (PF_ANEQ(&nk->addr[0], &sk->addr[0], s->pfs_1301.af) \|\|
nk->port[0] != sk->port[0]) {		nk->port[0] != sk->port[0]) {
ND_PRINT((ndo, " ("));		ND_PRINT((ndo, " ("));
print_host(ndo, &sk->addr[0], sk->port[0], s->af, NULL);		print_host(ndo, &sk->addr[0], sk->port[0], s->pfs_1301.af, NULL);
ND_PRINT((ndo, ")"));		ND_PRINT((ndo, ")"));
}		}

print_src_dst(ndo, src, dst, s->proto);		print_src_dst(ndo, src, dst, s->pfs_1301.proto);

if (ndo->ndo_vflag > 1) {		if (ndo->ndo_vflag > 1) {
uint64_t packets[2];		uint64_t packets[2];
uint64_t bytes[2];		uint64_t bytes[2];
uint32_t creation = ntohl(s->creation);		uint32_t creation = ntohl(s->pfs_1301.creation);
uint32_t expire = ntohl(s->expire);		uint32_t expire = ntohl(s->pfs_1301.expire);

sec = creation % 60;		sec = creation % 60;
creation /= 60;		creation /= 60;
min = creation % 60;		min = creation % 60;
creation /= 60;		creation /= 60;
ND_PRINT((ndo, "\n\tage %.2u:%.2u:%.2u", creation, min, sec));		ND_PRINT((ndo, "\n\tage %.2u:%.2u:%.2u", creation, min, sec));
sec = expire % 60;		sec = expire % 60;
expire /= 60;		expire /= 60;
min = expire % 60;		min = expire % 60;
expire /= 60;		expire /= 60;
ND_PRINT((ndo, ", expires in %.2u:%.2u:%.2u", expire, min, sec));		ND_PRINT((ndo, ", expires in %.2u:%.2u:%.2u", expire, min, sec));

bcopy(s->packets[0], &packets[0], sizeof(uint64_t));		bcopy(s->pfs_1301.packets[0], &packets[0], sizeof(uint64_t));
bcopy(s->packets[1], &packets[1], sizeof(uint64_t));		bcopy(s->pfs_1301.packets[1], &packets[1], sizeof(uint64_t));
bcopy(s->bytes[0], &bytes[0], sizeof(uint64_t));		bcopy(s->pfs_1301.bytes[0], &bytes[0], sizeof(uint64_t));
bcopy(s->bytes[1], &bytes[1], sizeof(uint64_t));		bcopy(s->pfs_1301.bytes[1], &bytes[1], sizeof(uint64_t));
ND_PRINT((ndo, ", %ju:%ju pkts, %ju:%ju bytes",		ND_PRINT((ndo, ", %ju:%ju pkts, %ju:%ju bytes",
be64toh(packets[0]), be64toh(packets[1]),		be64toh(packets[0]), be64toh(packets[1]),
be64toh(bytes[0]), be64toh(bytes[1])));		be64toh(bytes[0]), be64toh(bytes[1])));
if (s->anchor != ntohl(-1))		if (s->pfs_1301.anchor != ntohl(-1))
ND_PRINT((ndo, ", anchor %u", ntohl(s->anchor)));		ND_PRINT((ndo, ", anchor %u", ntohl(s->pfs_1301.anchor)));
if (s->rule != ntohl(-1))		if (s->pfs_1301.rule != ntohl(-1))
ND_PRINT((ndo, ", rule %u", ntohl(s->rule)));		ND_PRINT((ndo, ", rule %u", ntohl(s->pfs_1301.rule)));
}		}
if (ndo->ndo_vflag > 1) {		if (ndo->ndo_vflag > 1) {
uint64_t id;		uint64_t id;

bcopy(&s->id, &id, sizeof(uint64_t));		bcopy(&s->pfs_1301.id, &id, sizeof(uint64_t));
ND_PRINT((ndo, "\n\tid: %016jx creatorid: %08x",		ND_PRINT((ndo, "\n\tid: %016jx creatorid: %08x",
(uintmax_t )be64toh(id), ntohl(s->creatorid)));		(uintmax_t )be64toh(id), ntohl(s->pfs_1301.creatorid)));
}		}
}		}

View Options

sbin/ifconfig/ifpfsync.c

Show First 20 Lines • Show All 304 Lines • ▼ Show 20 Lines	setpfsync_defer(if_ctx ctx, const char val, int d)

if (pfsync_do_ioctl(ctx->io_s, SIOCSETPFSYNCNV, &nvl) == -1)		if (pfsync_do_ioctl(ctx->io_s, SIOCSETPFSYNCNV, &nvl) == -1)
err(1, "SIOCSETPFSYNCNV");		err(1, "SIOCSETPFSYNCNV");

nvlist_destroy(nvl);		nvlist_destroy(nvl);
}		}

static void		static void
		setpfsync_version(if_ctx ctx, const char val, int dummy __unused)
		{
		int version;
		nvlist_t *nvl = nvlist_create(0);

		/* Don't verify, kernel knows which versions are supported.*/
		version = atoi(val);

		if (pfsync_do_ioctl(ctx->io_s, SIOCGETPFSYNCNV, &nvl) == -1)
		err(1, "SIOCGETPFSYNCNV");

		nvlist_free_number(nvl, "version");
		nvlist_add_number(nvl, "version", version);

		if (pfsync_do_ioctl(ctx->io_s, SIOCSETPFSYNCNV, &nvl) == -1)
		err(1, "SIOCSETPFSYNCNV");

		nvlist_destroy(nvl);
		}

		static void
pfsync_status(if_ctx *ctx)		pfsync_status(if_ctx *ctx)
{		{
nvlist_t *nvl;		nvlist_t *nvl;
char syncdev[IFNAMSIZ];		char syncdev[IFNAMSIZ];
char syncpeer_str[NI_MAXHOST];		char syncpeer_str[NI_MAXHOST];
struct sockaddr_storage syncpeer;		struct sockaddr_storage syncpeer;
int maxupdates = 0;		int maxupdates = 0;
int flags = 0;		int flags = 0;
		int version;
int error;		int error;

nvl = nvlist_create(0);		nvl = nvlist_create(0);

if (pfsync_do_ioctl(ctx->io_s, SIOCGETPFSYNCNV, &nvl) == -1) {		if (pfsync_do_ioctl(ctx->io_s, SIOCGETPFSYNCNV, &nvl) == -1) {
nvlist_destroy(nvl);		nvlist_destroy(nvl);
return;		return;
}		}

memset((char *)&syncdev, 0, IFNAMSIZ);		memset((char *)&syncdev, 0, IFNAMSIZ);
if (nvlist_exists_string(nvl, "syncdev"))		if (nvlist_exists_string(nvl, "syncdev"))
strlcpy(syncdev, nvlist_get_string(nvl, "syncdev"),		strlcpy(syncdev, nvlist_get_string(nvl, "syncdev"),
IFNAMSIZ);		IFNAMSIZ);
if (nvlist_exists_number(nvl, "maxupdates"))		if (nvlist_exists_number(nvl, "maxupdates"))
maxupdates = nvlist_get_number(nvl, "maxupdates");		maxupdates = nvlist_get_number(nvl, "maxupdates");
		if (nvlist_exists_number(nvl, "version"))
		version = nvlist_get_number(nvl, "version");
if (nvlist_exists_number(nvl, "flags"))		if (nvlist_exists_number(nvl, "flags"))
flags = nvlist_get_number(nvl, "flags");		flags = nvlist_get_number(nvl, "flags");
if (nvlist_exists_nvlist(nvl, "syncpeer")) {		if (nvlist_exists_nvlist(nvl, "syncpeer")) {
pfsync_syncpeer_nvlist_to_sockaddr(nvlist_get_nvlist(nvl,		pfsync_syncpeer_nvlist_to_sockaddr(nvlist_get_nvlist(nvl,
"syncpeer"),		"syncpeer"),
&syncpeer);		&syncpeer);
}		}

Show All 14 Lines	if (syncpeer.ss_family == AF_INET &&
if ((error = getnameinfo(syncpeer_sa, syncpeer_sa->sa_len,		if ((error = getnameinfo(syncpeer_sa, syncpeer_sa->sa_len,
syncpeer_str, sizeof(syncpeer_str), NULL, 0,		syncpeer_str, sizeof(syncpeer_str), NULL, 0,
NI_NUMERICHOST)) != 0)		NI_NUMERICHOST)) != 0)
errx(1, "getnameinfo: %s", gai_strerror(error));		errx(1, "getnameinfo: %s", gai_strerror(error));
printf("syncpeer: %s ", syncpeer_str);		printf("syncpeer: %s ", syncpeer_str);
}		}

printf("maxupd: %d ", maxupdates);		printf("maxupd: %d ", maxupdates);
printf("defer: %s\n", (flags & PFSYNCF_DEFER) ? "on" : "off");		printf("defer: %s ", (flags & PFSYNCF_DEFER) ? "on" : "off");
		printf("version: %d\n", version);
printf("\tsyncok: %d\n", (flags & PFSYNCF_OK) ? 1 : 0);		printf("\tsyncok: %d\n", (flags & PFSYNCF_OK) ? 1 : 0);
}		}

static struct cmd pfsync_cmds[] = {		static struct cmd pfsync_cmds[] = {
DEF_CMD_ARG("syncdev", setpfsync_syncdev),		DEF_CMD_ARG("syncdev", setpfsync_syncdev),
DEF_CMD("-syncdev", 1, unsetpfsync_syncdev),		DEF_CMD("-syncdev", 1, unsetpfsync_syncdev),
DEF_CMD_ARG("syncif", setpfsync_syncdev),		DEF_CMD_ARG("syncif", setpfsync_syncdev),
DEF_CMD("-syncif", 1, unsetpfsync_syncdev),		DEF_CMD("-syncif", 1, unsetpfsync_syncdev),
DEF_CMD_ARG("syncpeer", setpfsync_syncpeer),		DEF_CMD_ARG("syncpeer", setpfsync_syncpeer),
DEF_CMD("-syncpeer", 1, unsetpfsync_syncpeer),		DEF_CMD("-syncpeer", 1, unsetpfsync_syncpeer),
DEF_CMD_ARG("maxupd", setpfsync_maxupd),		DEF_CMD_ARG("maxupd", setpfsync_maxupd),
DEF_CMD("defer", 1, setpfsync_defer),		DEF_CMD("defer", 1, setpfsync_defer),
DEF_CMD("-defer", 0, setpfsync_defer),		DEF_CMD("-defer", 0, setpfsync_defer),
		DEF_CMD_ARG("version", setpfsync_version),
};		};
static struct afswtch af_pfsync = {		static struct afswtch af_pfsync = {
.af_name = "af_pfsync",		.af_name = "af_pfsync",
.af_af = AF_UNSPEC,		.af_af = AF_UNSPEC,
.af_other_status = pfsync_status,		.af_other_status = pfsync_status,
};		};

static __constructor void		static __constructor void
pfsync_ctor(void)		pfsync_ctor(void)
{		{
for (size_t i = 0; i < nitems(pfsync_cmds); i++)		for (size_t i = 0; i < nitems(pfsync_cmds); i++)
cmd_register(&pfsync_cmds[i]);		cmd_register(&pfsync_cmds[i]);
af_register(&af_pfsync);		af_register(&af_pfsync);
}		}

View Options

sys/net/if_pfsync.h

	Show First 20 Lines • Show All 50 Lines • ▼ Show 20 Lines
	#define _NET_IF_PFSYNC_H_			#define _NET_IF_PFSYNC_H_

	#include <sys/types.h>			#include <sys/types.h>

	#include <net/if.h>			#include <net/if.h>
	#include <net/pfvar.h>			#include <net/pfvar.h>
	#include <netpfil/pf/pf.h>			#include <netpfil/pf/pf.h>

	#define PFSYNC_VERSION 5			#define PFSYNC_VERSION 5
				vegeta_tuxpowered.netAuthorUnsubmitted Done Inline Actions Please note that I've decided to not change the protocol version. Making the code work with messages from older peer would not be as easy as it is with subheaders. vegeta_tuxpowered.net: Please note that I've decided to not change the protocol version. Making the code work with…
	#define PFSYNC_DFLTTL 255			#define PFSYNC_DFLTTL 255

				enum pfsync_msg_versions {
				PFSYNC_MSG_VERSION_UNSPECIFIED = 0,
				PFSYNC_MSG_VERSION_1301 = 1301,
				PFSYNC_MSG_VERSION_1400 = 1400,
				vegeta_tuxpowered.netAuthorUnsubmitted Done Inline Actions A new version would be introduced only when compatibility is broken. In theory the 1301 version could be renamed to something lower. As far as my own experience with FreeBSD goes it could be probably 10.0. But I have tested it only with a 13.1 peer, so let's keep this as the initial value. vegeta_tuxpowered.net: A new version would be introduced only when compatibility is broken. In theory the 1301 version…
				};

				#define PFSYNC_MSG_VERSION_DEFAULT PFSYNC_MSG_VERSION_1400

	#define PFSYNC_ACT_CLR 0 /* clear all states */			#define PFSYNC_ACT_CLR 0 /* clear all states */
	#define PFSYNC_ACT_INS 1 /* insert state */			#define PFSYNC_ACT_INS_1301 1 /* insert state */
	#define PFSYNC_ACT_INS_ACK 2 /* ack of inserted state */			#define PFSYNC_ACT_INS_ACK 2 /* ack of inserted state */
	#define PFSYNC_ACT_UPD 3 /* update state */			#define PFSYNC_ACT_UPD_1301 3 /* update state */
	#define PFSYNC_ACT_UPD_C 4 /* "compressed" update state */			#define PFSYNC_ACT_UPD_C 4 /* "compressed" update state */
	#define PFSYNC_ACT_UPD_REQ 5 /* request "uncompressed" state */			#define PFSYNC_ACT_UPD_REQ 5 /* request "uncompressed" state */
	#define PFSYNC_ACT_DEL 6 /* delete state */			#define PFSYNC_ACT_DEL 6 /* delete state */
	#define PFSYNC_ACT_DEL_C 7 /* "compressed" delete state */			#define PFSYNC_ACT_DEL_C 7 /* "compressed" delete state */
	#define PFSYNC_ACT_INS_F 8 /* insert fragment */			#define PFSYNC_ACT_INS_F 8 /* insert fragment */
	#define PFSYNC_ACT_DEL_F 9 /* delete fragments */			#define PFSYNC_ACT_DEL_F 9 /* delete fragments */
	#define PFSYNC_ACT_BUS 10 /* bulk update status */			#define PFSYNC_ACT_BUS 10 /* bulk update status */
	#define PFSYNC_ACT_TDB 11 /* TDB replay counter update */			#define PFSYNC_ACT_TDB 11 /* TDB replay counter update */
	#define PFSYNC_ACT_EOF 12 /* end of frame */			#define PFSYNC_ACT_EOF 12 /* end of frame */
	#define PFSYNC_ACT_MAX 13			#define PFSYNC_ACT_INS_1400 13 /* insert state */
				#define PFSYNC_ACT_UPD_1400 14 /* update state */
				#define PFSYNC_ACT_MAX 15

	/*			/*
	* A pfsync frame is built from a header followed by several sections which			* A pfsync frame is built from a header followed by several sections which
	* are all prefixed with their own subheaders. Frames must be terminated with			* are all prefixed with their own subheaders. Frames must be terminated with
	* an EOF subheader.			* an EOF subheader.
	*			*
	* \| ... \|			* \| ... \|
	* \| IP header \|			* \| IP header \|
	▲ Show 20 Lines • Show All 162 Lines • ▼ Show 20 Lines
	#define PFSYNCF_DEFER 0x00000002			#define PFSYNCF_DEFER 0x00000002
	int pfsyncr_defer;			int pfsyncr_defer;
	};			};

	struct pfsync_kstatus {			struct pfsync_kstatus {
	char syncdev[IFNAMSIZ];			char syncdev[IFNAMSIZ];
	struct sockaddr_storage syncpeer;			struct sockaddr_storage syncpeer;
	int maxupdates;			int maxupdates;
				int version;
	int flags;			int flags;
	};			};

	struct pfsyncioc_nv {			struct pfsyncioc_nv {
	void *data;			void *data;
	size_t len; /* The length of the nvlist data. */			size_t len; /* The length of the nvlist data. */
	size_t size; /* The total size of the data buffer. */			size_t size; /* The total size of the data buffer. */
	};			};

	#define SIOCSETPFSYNC _IOW('i', 247, struct ifreq)			#define SIOCSETPFSYNC _IOW('i', 247, struct ifreq)
	#define SIOCGETPFSYNC _IOWR('i', 248, struct ifreq)			#define SIOCGETPFSYNC _IOWR('i', 248, struct ifreq)
	#define SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq)			#define SIOCSETPFSYNCNV _IOW('i', 249, struct ifreq)
	#define SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq)			#define SIOCGETPFSYNCNV _IOWR('i', 250, struct ifreq)

	#ifdef _KERNEL			#ifdef _KERNEL

	/*			/*
	* this shows where a pf state is with respect to the syncing.			* this shows where a pf state is with respect to the syncing.
				* pf_kstate->sync_state
	*/			*/
	#define PFSYNC_S_INS 0x00			#define PFSYNC_S_INS 0x00
	#define PFSYNC_S_IACK 0x01			#define PFSYNC_S_IACK 0x01
	#define PFSYNC_S_UPD 0x02			#define PFSYNC_S_UPD 0x02
	#define PFSYNC_S_UPD_C 0x03			#define PFSYNC_S_UPD_C 0x03
	#define PFSYNC_S_DEL_C 0x04			#define PFSYNC_S_DEL_C 0x04
	#define PFSYNC_S_COUNT 0x05

	#define PFSYNC_S_DEFER 0xfe			#define PFSYNC_S_DEFER 0xfe
	#define PFSYNC_S_NONE 0xff			#define PFSYNC_S_NONE 0xff

	#define PFSYNC_SI_IOCTL 0x01			#define PFSYNC_SI_IOCTL 0x01
	#define PFSYNC_SI_CKSUM 0x02			#define PFSYNC_SI_CKSUM 0x02
	#define PFSYNC_SI_ACK 0x04			#define PFSYNC_SI_ACK 0x04

	#endif /* _KERNEL */			#endif /* _KERNEL */

	#endif /* _NET_IF_PFSYNC_H_ */			#endif /* _NET_IF_PFSYNC_H_ */

View Options

sys/net/pfvar.h

View Options

sys/netpfil/pf/if_pfsync.c

View Options

sys/netpfil/pf/pf.c

View Options

sys/netpfil/pf/pf_ioctl.c

View Options

sys/netpfil/pf/pfsync_nv.c

View Options

Make contents of struct pfsync_state configurable
ClosedPublic
Actions

Details

Diff Detail

Event Timeline

Revision Contents
Changeset List

Diff 122383

contrib/tcpdump/print-pfsync.c

sbin/ifconfig/ifpfsync.c

sys/net/if_pfsync.h

sys/net/pfvar.h

sys/netpfil/pf/if_pfsync.c

sys/netpfil/pf/pf.c

sys/netpfil/pf/pf_ioctl.c

sys/netpfil/pf/pfsync_nv.c

usr.bin/netstat/if.c

Make contents of struct pfsync_state configurableClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 122383

contrib/tcpdump/print-pfsync.c

sbin/ifconfig/ifpfsync.c

sys/net/if_pfsync.h

sys/net/pfvar.h

sys/netpfil/pf/if_pfsync.c

sys/netpfil/pf/pf.c

sys/netpfil/pf/pf_ioctl.c

sys/netpfil/pf/pfsync_nv.c

usr.bin/netstat/if.c

Make contents of struct pfsync_state configurable
ClosedPublic
Actions

Revision Contents
Changeset List