| 896 | } |
| 897 | |
| 898 | static int |
| 899 | pfsync_in_upd(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count) |
| 900 | { |
| 901 | struct pfsync_softc *sc = V_pfsyncif; |
| 902 | struct pfsync_state *sa, *sp; |
| 903 | struct pf_state *st; |
| 904 | int sync; |
| 905 | |
| 906 | struct mbuf *mp; |
| 907 | int len = count * sizeof(*sp); |
| 908 | int offp, i; |
| 909 | |
| 910 | mp = m_pulldown(m, offset, len, &offp); |
| 911 | if (mp == NULL) { |
| 912 | V_pfsyncstats.pfsyncs_badlen++; |
| 913 | return (-1); |
| 914 | } |
| 915 | sa = (struct pfsync_state *)(mp->m_data + offp); |
| 916 | |
| 917 | for (i = 0; i < count; i++) { |
| 918 | sp = &sa[i]; |
| 919 | |
| 920 | /* check for invalid values */ |
| 921 | if (sp->timeout >= PFTM_MAX || |
| 922 | sp->src.state > PF_TCPS_PROXY_DST || |
| 923 | sp->dst.state > PF_TCPS_PROXY_DST) { |
| 924 | if (V_pf_status.debug >= PF_DEBUG_MISC) { |
| 925 | printf("pfsync_input: PFSYNC_ACT_UPD: " |
| 926 | "invalid value\n"); |
| 927 | } |
| 928 | V_pfsyncstats.pfsyncs_badval++; |
| 929 | continue; |
| 930 | } |
| 931 | |
| 932 | st = pf_find_state_byid(sp->id, sp->creatorid); |
| 933 | if (st == NULL) { |
| 934 | /* insert the update */ |
| 935 | if (pfsync_state_import(sp, pkt->flags)) |
| 936 | V_pfsyncstats.pfsyncs_badstate++; |
| 937 | continue; |
| 938 | } |
| 939 | |
| 940 | if (st->state_flags & PFSTATE_ACK) { |
| 941 | pfsync_undefer_state(st, 1); |
| 942 | } |
| 943 | |
| 944 | if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) |
| 945 | sync = pfsync_upd_tcp(st, &sp->src, &sp->dst); |
| 946 | else { |
| 947 | sync = 0; |
| 948 | |
| 949 | /* |
| 950 | * Non-TCP protocol state machine always go |
| 951 | * forwards |
| 952 | */ |
| 953 | if (st->src.state > sp->src.state) |
| 954 | sync++; |
| 955 | else |
nothing calls this directly
no test coverage detected