xref: /netbsd-src/sys/netinet/ip_carp.c (revision 63aea4bd5b445e491ff0389fe27ec78b3099dba3)
1 /*	$NetBSD: ip_carp.c,v 1.62 2015/08/24 22:21:26 pooka Exp $	*/
2 /*	$OpenBSD: ip_carp.c,v 1.113 2005/11/04 08:11:54 mcbride Exp $	*/
3 
4 /*
5  * Copyright (c) 2002 Michael Shalayeff. All rights reserved.
6  * Copyright (c) 2003 Ryan McBride. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
21  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
23  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
25  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
26  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #ifdef _KERNEL_OPT
31 #include "opt_inet.h"
32 #include "opt_mbuftrace.h"
33 #endif
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: ip_carp.c,v 1.62 2015/08/24 22:21:26 pooka Exp $");
37 
38 /*
39  * TODO:
40  *	- iface reconfigure
41  *	- support for hardware checksum calculations;
42  *
43  */
44 
45 #include <sys/param.h>
46 #include <sys/proc.h>
47 #include <sys/mbuf.h>
48 #include <sys/socket.h>
49 #include <sys/socketvar.h>
50 #include <sys/callout.h>
51 #include <sys/ioctl.h>
52 #include <sys/errno.h>
53 #include <sys/device.h>
54 #include <sys/time.h>
55 #include <sys/kernel.h>
56 #include <sys/kauth.h>
57 #include <sys/sysctl.h>
58 #include <sys/ucred.h>
59 #include <sys/syslog.h>
60 #include <sys/acct.h>
61 #include <sys/cprng.h>
62 
63 #include <sys/cpu.h>
64 
65 #include <net/if.h>
66 #include <net/pfil.h>
67 #include <net/if_types.h>
68 #include <net/if_ether.h>
69 #include <net/route.h>
70 #include <net/netisr.h>
71 #include <net/net_stats.h>
72 #include <netinet/if_inarp.h>
73 
74 #if NFDDI > 0
75 #include <net/if_fddi.h>
76 #endif
77 #if NTOKEN > 0
78 #include <net/if_token.h>
79 #endif
80 
81 #ifdef INET
82 #include <netinet/in.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/in_var.h>
85 #include <netinet/ip.h>
86 #include <netinet/ip_var.h>
87 
88 #include <net/if_dl.h>
89 #endif
90 
91 #ifdef INET6
92 #include <netinet/icmp6.h>
93 #include <netinet/ip6.h>
94 #include <netinet6/ip6_var.h>
95 #include <netinet6/nd6.h>
96 #include <netinet6/scope6_var.h>
97 #endif
98 
99 #include <net/bpf.h>
100 
101 #include <sys/sha1.h>
102 
103 #include <netinet/ip_carp.h>
104 
105 #include "ioconf.h"
106 
107 struct carp_mc_entry {
108 	LIST_ENTRY(carp_mc_entry)	mc_entries;
109 	union {
110 		struct ether_multi	*mcu_enm;
111 	} mc_u;
112 	struct sockaddr_storage		mc_addr;
113 };
114 #define	mc_enm	mc_u.mcu_enm
115 
116 struct carp_softc {
117 	struct ethercom sc_ac;
118 #define	sc_if		sc_ac.ec_if
119 #define	sc_carpdev	sc_ac.ec_if.if_carpdev
120 	int ah_cookie;
121 	int lh_cookie;
122 	struct ip_moptions sc_imo;
123 #ifdef INET6
124 	struct ip6_moptions sc_im6o;
125 #endif /* INET6 */
126 	TAILQ_ENTRY(carp_softc) sc_list;
127 
128 	enum { INIT = 0, BACKUP, MASTER }	sc_state;
129 
130 	int sc_suppress;
131 	int sc_bow_out;
132 
133 	int sc_sendad_errors;
134 #define CARP_SENDAD_MAX_ERRORS	3
135 	int sc_sendad_success;
136 #define CARP_SENDAD_MIN_SUCCESS 3
137 
138 	int sc_vhid;
139 	int sc_advskew;
140 	int sc_naddrs;
141 	int sc_naddrs6;
142 	int sc_advbase;		/* seconds */
143 	int sc_init_counter;
144 	u_int64_t sc_counter;
145 
146 	/* authentication */
147 #define CARP_HMAC_PAD	64
148 	unsigned char sc_key[CARP_KEY_LEN];
149 	unsigned char sc_pad[CARP_HMAC_PAD];
150 	SHA1_CTX sc_sha1;
151 	u_int32_t sc_hashkey[2];
152 
153 	struct callout sc_ad_tmo;	/* advertisement timeout */
154 	struct callout sc_md_tmo;	/* master down timeout */
155 	struct callout sc_md6_tmo;	/* master down timeout */
156 
157 	LIST_HEAD(__carp_mchead, carp_mc_entry)	carp_mc_listhead;
158 };
159 
160 int carp_suppress_preempt = 0;
161 static int carp_opts[CARPCTL_MAXID] = { 0, 1, 0, 0, 0 };	/* XXX for now */
162 
163 static percpu_t *carpstat_percpu;
164 
165 #define	CARP_STATINC(x)		_NET_STATINC(carpstat_percpu, x)
166 
167 #ifdef MBUFTRACE
168 static struct mowner carp_proto_mowner_rx = MOWNER_INIT("carp", "rx");
169 static struct mowner carp_proto_mowner_tx = MOWNER_INIT("carp", "tx");
170 static struct mowner carp_proto6_mowner_rx = MOWNER_INIT("carp6", "rx");
171 static struct mowner carp_proto6_mowner_tx = MOWNER_INIT("carp6", "tx");
172 #endif
173 
174 struct carp_if {
175 	TAILQ_HEAD(, carp_softc) vhif_vrs;
176 	int vhif_nvrs;
177 
178 	struct ifnet *vhif_ifp;
179 };
180 
181 #define	CARP_LOG(sc, s)							\
182 	if (carp_opts[CARPCTL_LOG]) {					\
183 		if (sc)							\
184 			log(LOG_INFO, "%s: ",				\
185 			    (sc)->sc_if.if_xname);			\
186 		else							\
187 			log(LOG_INFO, "carp: ");			\
188 		addlog s;						\
189 		addlog("\n");						\
190 	}
191 
192 static void	carp_hmac_prepare(struct carp_softc *);
193 static void	carp_hmac_generate(struct carp_softc *, u_int32_t *,
194 		    unsigned char *);
195 static int	carp_hmac_verify(struct carp_softc *, u_int32_t *,
196 		    unsigned char *);
197 static void	carp_setroute(struct carp_softc *, int);
198 static void	carp_proto_input_c(struct mbuf *, struct carp_header *,
199 		    sa_family_t);
200 static void	carpdetach(struct carp_softc *);
201 static int	carp_prepare_ad(struct mbuf *, struct carp_softc *,
202 		    struct carp_header *);
203 static void	carp_send_ad_all(void);
204 static void	carp_send_ad(void *);
205 static void	carp_send_arp(struct carp_softc *);
206 static void	carp_master_down(void *);
207 static int	carp_ioctl(struct ifnet *, u_long, void *);
208 static void	carp_start(struct ifnet *);
209 static void	carp_setrun(struct carp_softc *, sa_family_t);
210 static void	carp_set_state(struct carp_softc *, int);
211 static int	carp_addrcount(struct carp_if *, struct in_ifaddr *, int);
212 enum	{ CARP_COUNT_MASTER, CARP_COUNT_RUNNING };
213 
214 static void	carp_multicast_cleanup(struct carp_softc *);
215 static int	carp_set_ifp(struct carp_softc *, struct ifnet *);
216 static void	carp_set_enaddr(struct carp_softc *);
217 #if 0
218 static void	carp_addr_updated(void *);
219 #endif
220 static u_int32_t	carp_hash(struct carp_softc *, u_char *);
221 static int	carp_set_addr(struct carp_softc *, struct sockaddr_in *);
222 static int	carp_join_multicast(struct carp_softc *);
223 #ifdef INET6
224 static void	carp_send_na(struct carp_softc *);
225 static int	carp_set_addr6(struct carp_softc *, struct sockaddr_in6 *);
226 static int	carp_join_multicast6(struct carp_softc *);
227 #endif
228 static int	carp_clone_create(struct if_clone *, int);
229 static int	carp_clone_destroy(struct ifnet *);
230 static int	carp_ether_addmulti(struct carp_softc *, struct ifreq *);
231 static int	carp_ether_delmulti(struct carp_softc *, struct ifreq *);
232 static void	carp_ether_purgemulti(struct carp_softc *);
233 
234 static void	sysctl_net_inet_carp_setup(struct sysctllog **);
235 
236 struct if_clone carp_cloner =
237     IF_CLONE_INITIALIZER("carp", carp_clone_create, carp_clone_destroy);
238 
239 static __inline u_int16_t
240 carp_cksum(struct mbuf *m, int len)
241 {
242 	return (in_cksum(m, len));
243 }
244 
245 static void
246 carp_hmac_prepare(struct carp_softc *sc)
247 {
248 	u_int8_t carp_version = CARP_VERSION, type = CARP_ADVERTISEMENT;
249 	u_int8_t vhid = sc->sc_vhid & 0xff;
250 	SHA1_CTX sha1ctx;
251 	u_int32_t kmd[5];
252 	struct ifaddr *ifa;
253 	int i, found;
254 	struct in_addr last, cur, in;
255 #ifdef INET6
256 	struct in6_addr last6, cur6, in6;
257 #endif /* INET6 */
258 
259 	/* compute ipad from key */
260 	memset(sc->sc_pad, 0, sizeof(sc->sc_pad));
261 	memcpy(sc->sc_pad, sc->sc_key, sizeof(sc->sc_key));
262 	for (i = 0; i < sizeof(sc->sc_pad); i++)
263 		sc->sc_pad[i] ^= 0x36;
264 
265 	/* precompute first part of inner hash */
266 	SHA1Init(&sc->sc_sha1);
267 	SHA1Update(&sc->sc_sha1, sc->sc_pad, sizeof(sc->sc_pad));
268 	SHA1Update(&sc->sc_sha1, (void *)&carp_version, sizeof(carp_version));
269 	SHA1Update(&sc->sc_sha1, (void *)&type, sizeof(type));
270 
271 	/* generate a key for the arpbalance hash, before the vhid is hashed */
272 	memcpy(&sha1ctx, &sc->sc_sha1, sizeof(sha1ctx));
273 	SHA1Final((unsigned char *)kmd, &sha1ctx);
274 	sc->sc_hashkey[0] = kmd[0] ^ kmd[1];
275 	sc->sc_hashkey[1] = kmd[2] ^ kmd[3];
276 
277 	/* the rest of the precomputation */
278 	SHA1Update(&sc->sc_sha1, (void *)&vhid, sizeof(vhid));
279 
280 	/* Hash the addresses from smallest to largest, not interface order */
281 #ifdef INET
282 	cur.s_addr = 0;
283 	do {
284 		found = 0;
285 		last = cur;
286 		cur.s_addr = 0xffffffff;
287 		IFADDR_FOREACH(ifa, &sc->sc_if) {
288 			in.s_addr = ifatoia(ifa)->ia_addr.sin_addr.s_addr;
289 			if (ifa->ifa_addr->sa_family == AF_INET &&
290 			    ntohl(in.s_addr) > ntohl(last.s_addr) &&
291 			    ntohl(in.s_addr) < ntohl(cur.s_addr)) {
292 				cur.s_addr = in.s_addr;
293 				found++;
294 			}
295 		}
296 		if (found)
297 			SHA1Update(&sc->sc_sha1, (void *)&cur, sizeof(cur));
298 	} while (found);
299 #endif /* INET */
300 
301 #ifdef INET6
302 	memset(&cur6, 0x00, sizeof(cur6));
303 	do {
304 		found = 0;
305 		last6 = cur6;
306 		memset(&cur6, 0xff, sizeof(cur6));
307 		IFADDR_FOREACH(ifa, &sc->sc_if) {
308 			in6 = ifatoia6(ifa)->ia_addr.sin6_addr;
309 			if (IN6_IS_ADDR_LINKLOCAL(&in6))
310 				in6.s6_addr16[1] = 0;
311 			if (ifa->ifa_addr->sa_family == AF_INET6 &&
312 			    memcmp(&in6, &last6, sizeof(in6)) > 0 &&
313 			    memcmp(&in6, &cur6, sizeof(in6)) < 0) {
314 				cur6 = in6;
315 				found++;
316 			}
317 		}
318 		if (found)
319 			SHA1Update(&sc->sc_sha1, (void *)&cur6, sizeof(cur6));
320 	} while (found);
321 #endif /* INET6 */
322 
323 	/* convert ipad to opad */
324 	for (i = 0; i < sizeof(sc->sc_pad); i++)
325 		sc->sc_pad[i] ^= 0x36 ^ 0x5c;
326 }
327 
328 static void
329 carp_hmac_generate(struct carp_softc *sc, u_int32_t counter[2],
330     unsigned char md[20])
331 {
332 	SHA1_CTX sha1ctx;
333 
334 	/* fetch first half of inner hash */
335 	memcpy(&sha1ctx, &sc->sc_sha1, sizeof(sha1ctx));
336 
337 	SHA1Update(&sha1ctx, (void *)counter, sizeof(sc->sc_counter));
338 	SHA1Final(md, &sha1ctx);
339 
340 	/* outer hash */
341 	SHA1Init(&sha1ctx);
342 	SHA1Update(&sha1ctx, sc->sc_pad, sizeof(sc->sc_pad));
343 	SHA1Update(&sha1ctx, md, 20);
344 	SHA1Final(md, &sha1ctx);
345 }
346 
347 static int
348 carp_hmac_verify(struct carp_softc *sc, u_int32_t counter[2],
349     unsigned char md[20])
350 {
351 	unsigned char md2[20];
352 
353 	carp_hmac_generate(sc, counter, md2);
354 
355 	return (memcmp(md, md2, sizeof(md2)));
356 }
357 
358 static void
359 carp_setroute(struct carp_softc *sc, int cmd)
360 {
361 	struct ifaddr *ifa;
362 	int s;
363 
364 	KERNEL_LOCK(1, NULL);
365 	s = splsoftnet();
366 	IFADDR_FOREACH(ifa, &sc->sc_if) {
367 		switch (ifa->ifa_addr->sa_family) {
368 		case AF_INET: {
369 			int count = 0;
370 			struct rtentry *rt;
371 			int hr_otherif, nr_ourif;
372 
373 			/*
374 			 * Avoid screwing with the routes if there are other
375 			 * carp interfaces which are master and have the same
376 			 * address.
377 			 */
378 			if (sc->sc_carpdev != NULL &&
379 			    sc->sc_carpdev->if_carp != NULL) {
380 				count = carp_addrcount(
381 				    (struct carp_if *)sc->sc_carpdev->if_carp,
382 				    ifatoia(ifa), CARP_COUNT_MASTER);
383 				if ((cmd == RTM_ADD && count != 1) ||
384 				    (cmd == RTM_DELETE && count != 0))
385 					continue;
386 			}
387 
388 			/* Remove the existing host route, if any */
389 			rtrequest(RTM_DELETE, ifa->ifa_addr,
390 			    ifa->ifa_addr, ifa->ifa_netmask,
391 			    RTF_HOST, NULL);
392 
393 			rt = NULL;
394 			(void)rtrequest(RTM_GET, ifa->ifa_addr, ifa->ifa_addr,
395 			    ifa->ifa_netmask, RTF_HOST, &rt);
396 			hr_otherif = (rt && rt->rt_ifp != &sc->sc_if &&
397 			    rt->rt_flags & (RTF_CLONING|RTF_CLONED));
398 			if (rt != NULL) {
399 				rtfree(rt);
400 				rt = NULL;
401 			}
402 
403 			/* Check for a network route on our interface */
404 
405 			rt = NULL;
406 			(void)rtrequest(RTM_GET, ifa->ifa_addr, ifa->ifa_addr,
407 			    ifa->ifa_netmask, 0, &rt);
408 			nr_ourif = (rt && rt->rt_ifp == &sc->sc_if);
409 
410 			switch (cmd) {
411 			case RTM_ADD:
412 				if (hr_otherif) {
413 					ifa->ifa_rtrequest = NULL;
414 					ifa->ifa_flags &= ~RTF_CLONING;
415 
416 					rtrequest(RTM_ADD, ifa->ifa_addr,
417 					    ifa->ifa_addr, ifa->ifa_netmask,
418 					    RTF_UP | RTF_HOST, NULL);
419 				}
420 				if (!hr_otherif || nr_ourif || !rt) {
421 					if (nr_ourif && !(rt->rt_flags &
422 					    RTF_CLONING))
423 						rtrequest(RTM_DELETE,
424 						    ifa->ifa_addr,
425 						    ifa->ifa_addr,
426 						    ifa->ifa_netmask, 0, NULL);
427 
428 					ifa->ifa_rtrequest = arp_rtrequest;
429 					ifa->ifa_flags |= RTF_CLONING;
430 
431 					if (rtrequest(RTM_ADD, ifa->ifa_addr,
432 					    ifa->ifa_addr, ifa->ifa_netmask, 0,
433 					    NULL) == 0)
434 						ifa->ifa_flags |= IFA_ROUTE;
435 				}
436 				break;
437 			case RTM_DELETE:
438 				break;
439 			default:
440 				break;
441 			}
442 			if (rt != NULL) {
443 				rtfree(rt);
444 				rt = NULL;
445 			}
446 			break;
447 		}
448 
449 #ifdef INET6
450 		case AF_INET6:
451 			if (cmd == RTM_ADD)
452 				in6_ifaddlocal(ifa);
453 			else
454 				in6_ifremlocal(ifa);
455 			break;
456 #endif /* INET6 */
457 		default:
458 			break;
459 		}
460 	}
461 	splx(s);
462 	KERNEL_UNLOCK_ONE(NULL);
463 }
464 
465 /*
466  * process input packet.
467  * we have rearranged checks order compared to the rfc,
468  * but it seems more efficient this way or not possible otherwise.
469  */
470 void
471 carp_proto_input(struct mbuf *m, ...)
472 {
473 	struct ip *ip = mtod(m, struct ip *);
474 	struct carp_softc *sc = NULL;
475 	struct carp_header *ch;
476 	int iplen, len;
477 	va_list ap;
478 
479 	va_start(ap, m);
480 	va_end(ap);
481 
482 	CARP_STATINC(CARP_STAT_IPACKETS);
483 	MCLAIM(m, &carp_proto_mowner_rx);
484 
485 	if (!carp_opts[CARPCTL_ALLOW]) {
486 		m_freem(m);
487 		return;
488 	}
489 
490 	/* check if received on a valid carp interface */
491 	if (m->m_pkthdr.rcvif->if_type != IFT_CARP) {
492 		CARP_STATINC(CARP_STAT_BADIF);
493 		CARP_LOG(sc, ("packet received on non-carp interface: %s",
494 		    m->m_pkthdr.rcvif->if_xname));
495 		m_freem(m);
496 		return;
497 	}
498 
499 	/* verify that the IP TTL is 255.  */
500 	if (ip->ip_ttl != CARP_DFLTTL) {
501 		CARP_STATINC(CARP_STAT_BADTTL);
502 		CARP_LOG(sc, ("received ttl %d != %d on %s", ip->ip_ttl,
503 		    CARP_DFLTTL, m->m_pkthdr.rcvif->if_xname));
504 		m_freem(m);
505 		return;
506 	}
507 
508 	/*
509 	 * verify that the received packet length is
510 	 * equal to the CARP header
511 	 */
512 	iplen = ip->ip_hl << 2;
513 	len = iplen + sizeof(*ch);
514 	if (len > m->m_pkthdr.len) {
515 		CARP_STATINC(CARP_STAT_BADLEN);
516 		CARP_LOG(sc, ("packet too short %d on %s", m->m_pkthdr.len,
517 		    m->m_pkthdr.rcvif->if_xname));
518 		m_freem(m);
519 		return;
520 	}
521 
522 	if ((m = m_pullup(m, len)) == NULL) {
523 		CARP_STATINC(CARP_STAT_HDROPS);
524 		return;
525 	}
526 	ip = mtod(m, struct ip *);
527 	ch = (struct carp_header *)((char *)ip + iplen);
528 	/* verify the CARP checksum */
529 	m->m_data += iplen;
530 	if (carp_cksum(m, len - iplen)) {
531 		CARP_STATINC(CARP_STAT_BADSUM);
532 		CARP_LOG(sc, ("checksum failed on %s",
533 		    m->m_pkthdr.rcvif->if_xname));
534 		m_freem(m);
535 		return;
536 	}
537 	m->m_data -= iplen;
538 
539 	carp_proto_input_c(m, ch, AF_INET);
540 }
541 
542 #ifdef INET6
543 int
544 carp6_proto_input(struct mbuf **mp, int *offp, int proto)
545 {
546 	struct mbuf *m = *mp;
547 	struct carp_softc *sc = NULL;
548 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
549 	struct carp_header *ch;
550 	u_int len;
551 
552 	CARP_STATINC(CARP_STAT_IPACKETS6);
553 	MCLAIM(m, &carp_proto6_mowner_rx);
554 
555 	if (!carp_opts[CARPCTL_ALLOW]) {
556 		m_freem(m);
557 		return (IPPROTO_DONE);
558 	}
559 
560 	/* check if received on a valid carp interface */
561 	if (m->m_pkthdr.rcvif->if_type != IFT_CARP) {
562 		CARP_STATINC(CARP_STAT_BADIF);
563 		CARP_LOG(sc, ("packet received on non-carp interface: %s",
564 		    m->m_pkthdr.rcvif->if_xname));
565 		m_freem(m);
566 		return (IPPROTO_DONE);
567 	}
568 
569 	/* verify that the IP TTL is 255 */
570 	if (ip6->ip6_hlim != CARP_DFLTTL) {
571 		CARP_STATINC(CARP_STAT_BADTTL);
572 		CARP_LOG(sc, ("received ttl %d != %d on %s", ip6->ip6_hlim,
573 		    CARP_DFLTTL, m->m_pkthdr.rcvif->if_xname));
574 		m_freem(m);
575 		return (IPPROTO_DONE);
576 	}
577 
578 	/* verify that we have a complete carp packet */
579 	len = m->m_len;
580 	IP6_EXTHDR_GET(ch, struct carp_header *, m, *offp, sizeof(*ch));
581 	if (ch == NULL) {
582 		CARP_STATINC(CARP_STAT_BADLEN);
583 		CARP_LOG(sc, ("packet size %u too small", len));
584 		return (IPPROTO_DONE);
585 	}
586 
587 
588 	/* verify the CARP checksum */
589 	m->m_data += *offp;
590 	if (carp_cksum(m, sizeof(*ch))) {
591 		CARP_STATINC(CARP_STAT_BADSUM);
592 		CARP_LOG(sc, ("checksum failed, on %s",
593 		    m->m_pkthdr.rcvif->if_xname));
594 		m_freem(m);
595 		return (IPPROTO_DONE);
596 	}
597 	m->m_data -= *offp;
598 
599 	carp_proto_input_c(m, ch, AF_INET6);
600 	return (IPPROTO_DONE);
601 }
602 #endif /* INET6 */
603 
604 static void
605 carp_proto_input_c(struct mbuf *m, struct carp_header *ch, sa_family_t af)
606 {
607 	struct carp_softc *sc;
608 	u_int64_t tmp_counter;
609 	struct timeval sc_tv, ch_tv;
610 
611 	TAILQ_FOREACH(sc, &((struct carp_if *)
612 	    m->m_pkthdr.rcvif->if_carpdev->if_carp)->vhif_vrs, sc_list)
613 		if (sc->sc_vhid == ch->carp_vhid)
614 			break;
615 
616 	if (!sc || (sc->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) !=
617 	    (IFF_UP|IFF_RUNNING)) {
618 		CARP_STATINC(CARP_STAT_BADVHID);
619 		m_freem(m);
620 		return;
621 	}
622 
623 	/*
624 	 * Check if our own advertisement was duplicated
625 	 * from a non simplex interface.
626 	 * XXX If there is no address on our physical interface
627 	 * there is no way to distinguish our ads from the ones
628 	 * another carp host might have sent us.
629 	 */
630 	if ((sc->sc_carpdev->if_flags & IFF_SIMPLEX) == 0) {
631 		struct sockaddr sa;
632 		struct ifaddr *ifa;
633 
634 		memset(&sa, 0, sizeof(sa));
635 		sa.sa_family = af;
636 		ifa = ifaof_ifpforaddr(&sa, sc->sc_carpdev);
637 
638 		if (ifa && af == AF_INET) {
639 			struct ip *ip = mtod(m, struct ip *);
640 			if (ip->ip_src.s_addr ==
641 					ifatoia(ifa)->ia_addr.sin_addr.s_addr) {
642 				m_freem(m);
643 				return;
644 			}
645 		}
646 #ifdef INET6
647 		if (ifa && af == AF_INET6) {
648 			struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
649 			struct in6_addr in6_src, in6_found;
650 
651 			in6_src = ip6->ip6_src;
652 			in6_found = ifatoia6(ifa)->ia_addr.sin6_addr;
653 			if (IN6_IS_ADDR_LINKLOCAL(&in6_src))
654 				in6_src.s6_addr16[1] = 0;
655 			if (IN6_IS_ADDR_LINKLOCAL(&in6_found))
656 				in6_found.s6_addr16[1] = 0;
657 			if (IN6_ARE_ADDR_EQUAL(&in6_src, &in6_found)) {
658 				m_freem(m);
659 				return;
660 			}
661 		}
662 #endif /* INET6 */
663 	}
664 
665 	nanotime(&sc->sc_if.if_lastchange);
666 	sc->sc_if.if_ipackets++;
667 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
668 
669 	/* verify the CARP version. */
670 	if (ch->carp_version != CARP_VERSION) {
671 		CARP_STATINC(CARP_STAT_BADVER);
672 		sc->sc_if.if_ierrors++;
673 		CARP_LOG(sc, ("invalid version %d != %d",
674 		    ch->carp_version, CARP_VERSION));
675 		m_freem(m);
676 		return;
677 	}
678 
679 	/* verify the hash */
680 	if (carp_hmac_verify(sc, ch->carp_counter, ch->carp_md)) {
681 		CARP_STATINC(CARP_STAT_BADAUTH);
682 		sc->sc_if.if_ierrors++;
683 		CARP_LOG(sc, ("incorrect hash"));
684 		m_freem(m);
685 		return;
686 	}
687 
688 	tmp_counter = ntohl(ch->carp_counter[0]);
689 	tmp_counter = tmp_counter<<32;
690 	tmp_counter += ntohl(ch->carp_counter[1]);
691 
692 	/* XXX Replay protection goes here */
693 
694 	sc->sc_init_counter = 0;
695 	sc->sc_counter = tmp_counter;
696 
697 
698 	sc_tv.tv_sec = sc->sc_advbase;
699 	if (carp_suppress_preempt && sc->sc_advskew <  240)
700 		sc_tv.tv_usec = 240 * 1000000 / 256;
701 	else
702 		sc_tv.tv_usec = sc->sc_advskew * 1000000 / 256;
703 	ch_tv.tv_sec = ch->carp_advbase;
704 	ch_tv.tv_usec = ch->carp_advskew * 1000000 / 256;
705 
706 	switch (sc->sc_state) {
707 	case INIT:
708 		break;
709 	case MASTER:
710 		/*
711 		 * If we receive an advertisement from a backup who's going to
712 		 * be more frequent than us, go into BACKUP state.
713 		 */
714 		if (timercmp(&sc_tv, &ch_tv, >) ||
715 		    timercmp(&sc_tv, &ch_tv, ==)) {
716 			callout_stop(&sc->sc_ad_tmo);
717 			CARP_LOG(sc, ("MASTER -> BACKUP (more frequent advertisement received)"));
718 			carp_set_state(sc, BACKUP);
719 			carp_setrun(sc, 0);
720 			carp_setroute(sc, RTM_DELETE);
721 		}
722 		break;
723 	case BACKUP:
724 		/*
725 		 * If we're pre-empting masters who advertise slower than us,
726 		 * and this one claims to be slower, treat him as down.
727 		 */
728 		if (carp_opts[CARPCTL_PREEMPT] && timercmp(&sc_tv, &ch_tv, <)) {
729 			CARP_LOG(sc, ("BACKUP -> MASTER (preempting a slower master)"));
730 			carp_master_down(sc);
731 			break;
732 		}
733 
734 		/*
735 		 *  If the master is going to advertise at such a low frequency
736 		 *  that he's guaranteed to time out, we'd might as well just
737 		 *  treat him as timed out now.
738 		 */
739 		sc_tv.tv_sec = sc->sc_advbase * 3;
740 		if (timercmp(&sc_tv, &ch_tv, <)) {
741 			CARP_LOG(sc, ("BACKUP -> MASTER (master timed out)"));
742 			carp_master_down(sc);
743 			break;
744 		}
745 
746 		/*
747 		 * Otherwise, we reset the counter and wait for the next
748 		 * advertisement.
749 		 */
750 		carp_setrun(sc, af);
751 		break;
752 	}
753 
754 	m_freem(m);
755 	return;
756 }
757 
758 /*
759  * Interface side of the CARP implementation.
760  */
761 
762 /* ARGSUSED */
763 void
764 carpattach(int n)
765 {
766 	if_clone_attach(&carp_cloner);
767 
768 	carpstat_percpu = percpu_alloc(sizeof(uint64_t) * CARP_NSTATS);
769 }
770 
771 static int
772 carp_clone_create(struct if_clone *ifc, int unit)
773 {
774 	extern int ifqmaxlen;
775 	struct carp_softc *sc;
776 	struct ifnet *ifp;
777 
778 	sc = malloc(sizeof(*sc), M_DEVBUF, M_NOWAIT|M_ZERO);
779 	if (!sc)
780 		return (ENOMEM);
781 
782 	sc->sc_suppress = 0;
783 	sc->sc_advbase = CARP_DFLTINTV;
784 	sc->sc_vhid = -1;	/* required setting */
785 	sc->sc_advskew = 0;
786 	sc->sc_init_counter = 1;
787 	sc->sc_naddrs = sc->sc_naddrs6 = 0;
788 #ifdef INET6
789 	sc->sc_im6o.im6o_multicast_hlim = CARP_DFLTTL;
790 #endif /* INET6 */
791 
792 	callout_init(&sc->sc_ad_tmo, 0);
793 	callout_init(&sc->sc_md_tmo, 0);
794 	callout_init(&sc->sc_md6_tmo, 0);
795 
796 	callout_setfunc(&sc->sc_ad_tmo, carp_send_ad, sc);
797 	callout_setfunc(&sc->sc_md_tmo, carp_master_down, sc);
798 	callout_setfunc(&sc->sc_md6_tmo, carp_master_down, sc);
799 
800 	LIST_INIT(&sc->carp_mc_listhead);
801 	ifp = &sc->sc_if;
802 	ifp->if_softc = sc;
803 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
804 	    unit);
805 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
806 	ifp->if_ioctl = carp_ioctl;
807 	ifp->if_start = carp_start;
808 	ifp->if_output = carp_output;
809 	ifp->if_type = IFT_CARP;
810 	ifp->if_addrlen = ETHER_ADDR_LEN;
811 	ifp->if_hdrlen = ETHER_HDR_LEN;
812 	ifp->if_mtu = ETHERMTU;
813 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
814 	IFQ_SET_READY(&ifp->if_snd);
815 	if_attach(ifp);
816 
817 	if_alloc_sadl(ifp);
818 	ifp->if_broadcastaddr = etherbroadcastaddr;
819 	carp_set_enaddr(sc);
820 	LIST_INIT(&sc->sc_ac.ec_multiaddrs);
821 	bpf_attach(ifp, DLT_EN10MB, ETHER_HDR_LEN);
822 #ifdef MBUFTRACE
823 	strlcpy(sc->sc_ac.ec_tx_mowner.mo_name, ifp->if_xname,
824 	    sizeof(sc->sc_ac.ec_tx_mowner.mo_name));
825 	strlcpy(sc->sc_ac.ec_tx_mowner.mo_descr, "tx",
826 	    sizeof(sc->sc_ac.ec_tx_mowner.mo_descr));
827 	strlcpy(sc->sc_ac.ec_rx_mowner.mo_name, ifp->if_xname,
828 	    sizeof(sc->sc_ac.ec_rx_mowner.mo_name));
829 	strlcpy(sc->sc_ac.ec_rx_mowner.mo_descr, "rx",
830 	    sizeof(sc->sc_ac.ec_rx_mowner.mo_descr));
831 	MOWNER_ATTACH(&sc->sc_ac.ec_tx_mowner);
832 	MOWNER_ATTACH(&sc->sc_ac.ec_rx_mowner);
833 	ifp->if_mowner = &sc->sc_ac.ec_tx_mowner;
834 #endif
835 	return (0);
836 }
837 
838 static int
839 carp_clone_destroy(struct ifnet *ifp)
840 {
841 	struct carp_softc *sc = ifp->if_softc;
842 
843 	carpdetach(ifp->if_softc);
844 	ether_ifdetach(ifp);
845 	if_detach(ifp);
846 	callout_destroy(&sc->sc_ad_tmo);
847 	callout_destroy(&sc->sc_md_tmo);
848 	callout_destroy(&sc->sc_md6_tmo);
849 	free(ifp->if_softc, M_DEVBUF);
850 
851 	return (0);
852 }
853 
854 static void
855 carpdetach(struct carp_softc *sc)
856 {
857 	struct carp_if *cif;
858 	int s;
859 
860 	callout_stop(&sc->sc_ad_tmo);
861 	callout_stop(&sc->sc_md_tmo);
862 	callout_stop(&sc->sc_md6_tmo);
863 
864 	if (sc->sc_suppress)
865 		carp_suppress_preempt--;
866 	sc->sc_suppress = 0;
867 
868 	if (sc->sc_sendad_errors >= CARP_SENDAD_MAX_ERRORS)
869 		carp_suppress_preempt--;
870 	sc->sc_sendad_errors = 0;
871 
872 	carp_set_state(sc, INIT);
873 	sc->sc_if.if_flags &= ~IFF_UP;
874 	carp_setrun(sc, 0);
875 	carp_multicast_cleanup(sc);
876 
877 	KERNEL_LOCK(1, NULL);
878 	s = splnet();
879 	if (sc->sc_carpdev != NULL) {
880 		/* XXX linkstatehook removal */
881 		cif = (struct carp_if *)sc->sc_carpdev->if_carp;
882 		TAILQ_REMOVE(&cif->vhif_vrs, sc, sc_list);
883 		if (!--cif->vhif_nvrs) {
884 			ifpromisc(sc->sc_carpdev, 0);
885 			sc->sc_carpdev->if_carp = NULL;
886 			free(cif, M_IFADDR);
887 		}
888 	}
889 	sc->sc_carpdev = NULL;
890 	splx(s);
891 	KERNEL_UNLOCK_ONE(NULL);
892 }
893 
894 /* Detach an interface from the carp. */
895 void
896 carp_ifdetach(struct ifnet *ifp)
897 {
898 	struct carp_softc *sc, *nextsc;
899 	struct carp_if *cif = (struct carp_if *)ifp->if_carp;
900 
901 	for (sc = TAILQ_FIRST(&cif->vhif_vrs); sc; sc = nextsc) {
902 		nextsc = TAILQ_NEXT(sc, sc_list);
903 		carpdetach(sc);
904 	}
905 }
906 
907 static int
908 carp_prepare_ad(struct mbuf *m, struct carp_softc *sc,
909     struct carp_header *ch)
910 {
911 	if (sc->sc_init_counter) {
912 		/* this could also be seconds since unix epoch */
913 		sc->sc_counter = cprng_fast64();
914 	} else
915 		sc->sc_counter++;
916 
917 	ch->carp_counter[0] = htonl((sc->sc_counter>>32)&0xffffffff);
918 	ch->carp_counter[1] = htonl(sc->sc_counter&0xffffffff);
919 
920 	carp_hmac_generate(sc, ch->carp_counter, ch->carp_md);
921 
922 	return (0);
923 }
924 
925 static void
926 carp_send_ad_all(void)
927 {
928 	struct ifnet *ifp;
929 	struct carp_if *cif;
930 	struct carp_softc *vh;
931 
932 	IFNET_FOREACH(ifp) {
933 		if (ifp->if_carp == NULL || ifp->if_type == IFT_CARP)
934 			continue;
935 
936 		cif = (struct carp_if *)ifp->if_carp;
937 		TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list) {
938 			if ((vh->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) ==
939 			    (IFF_UP|IFF_RUNNING) && vh->sc_state == MASTER)
940 				carp_send_ad(vh);
941 		}
942 	}
943 }
944 
945 
946 static void
947 carp_send_ad(void *v)
948 {
949 	struct carp_header ch;
950 	struct timeval tv;
951 	struct carp_softc *sc = v;
952 	struct carp_header *ch_ptr;
953 	struct mbuf *m;
954 	int error, len, advbase, advskew, s;
955 	struct ifaddr *ifa;
956 	struct sockaddr sa;
957 
958 	KERNEL_LOCK(1, NULL);
959 	s = splsoftnet();
960 
961 	advbase = advskew = 0; /* Sssssh compiler */
962 	if (sc->sc_carpdev == NULL) {
963 		sc->sc_if.if_oerrors++;
964 		goto retry_later;
965 	}
966 
967 	/* bow out if we've gone to backup (the carp interface is going down) */
968 	if (sc->sc_bow_out) {
969 		sc->sc_bow_out = 0;
970 		advbase = 255;
971 		advskew = 255;
972 	} else {
973 		advbase = sc->sc_advbase;
974 		if (!carp_suppress_preempt || sc->sc_advskew > 240)
975 			advskew = sc->sc_advskew;
976 		else
977 			advskew = 240;
978 		tv.tv_sec = advbase;
979 		tv.tv_usec = advskew * 1000000 / 256;
980 	}
981 
982 	ch.carp_version = CARP_VERSION;
983 	ch.carp_type = CARP_ADVERTISEMENT;
984 	ch.carp_vhid = sc->sc_vhid;
985 	ch.carp_advbase = advbase;
986 	ch.carp_advskew = advskew;
987 	ch.carp_authlen = 7;	/* XXX DEFINE */
988 	ch.carp_pad1 = 0;	/* must be zero */
989 	ch.carp_cksum = 0;
990 
991 
992 #ifdef INET
993 	if (sc->sc_naddrs) {
994 		struct ip *ip;
995 
996 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
997 		if (m == NULL) {
998 			sc->sc_if.if_oerrors++;
999 			CARP_STATINC(CARP_STAT_ONOMEM);
1000 			/* XXX maybe less ? */
1001 			goto retry_later;
1002 		}
1003 		MCLAIM(m, &carp_proto_mowner_tx);
1004 		len = sizeof(*ip) + sizeof(ch);
1005 		m->m_pkthdr.len = len;
1006 		m->m_pkthdr.rcvif = NULL;
1007 		m->m_len = len;
1008 		MH_ALIGN(m, m->m_len);
1009 		m->m_flags |= M_MCAST;
1010 		ip = mtod(m, struct ip *);
1011 		ip->ip_v = IPVERSION;
1012 		ip->ip_hl = sizeof(*ip) >> 2;
1013 		ip->ip_tos = IPTOS_LOWDELAY;
1014 		ip->ip_len = htons(len);
1015 		ip->ip_id = 0;	/* no need for id, we don't support fragments */
1016 		ip->ip_off = htons(IP_DF);
1017 		ip->ip_ttl = CARP_DFLTTL;
1018 		ip->ip_p = IPPROTO_CARP;
1019 		ip->ip_sum = 0;
1020 
1021 		memset(&sa, 0, sizeof(sa));
1022 		sa.sa_family = AF_INET;
1023 		ifa = ifaof_ifpforaddr(&sa, sc->sc_carpdev);
1024 		if (ifa == NULL)
1025 			ip->ip_src.s_addr = 0;
1026 		else
1027 			ip->ip_src.s_addr =
1028 			    ifatoia(ifa)->ia_addr.sin_addr.s_addr;
1029 		ip->ip_dst.s_addr = INADDR_CARP_GROUP;
1030 
1031 		ch_ptr = (struct carp_header *)(&ip[1]);
1032 		memcpy(ch_ptr, &ch, sizeof(ch));
1033 		if (carp_prepare_ad(m, sc, ch_ptr))
1034 			goto retry_later;
1035 
1036 		m->m_data += sizeof(*ip);
1037 		ch_ptr->carp_cksum = carp_cksum(m, len - sizeof(*ip));
1038 		m->m_data -= sizeof(*ip);
1039 
1040 		nanotime(&sc->sc_if.if_lastchange);
1041 		sc->sc_if.if_opackets++;
1042 		sc->sc_if.if_obytes += len;
1043 		CARP_STATINC(CARP_STAT_OPACKETS);
1044 
1045 		error = ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo,
1046 		    NULL);
1047 		if (error) {
1048 			if (error == ENOBUFS)
1049 				CARP_STATINC(CARP_STAT_ONOMEM);
1050 			else
1051 				CARP_LOG(sc, ("ip_output failed: %d", error));
1052 			sc->sc_if.if_oerrors++;
1053 			if (sc->sc_sendad_errors < INT_MAX)
1054 				sc->sc_sendad_errors++;
1055 			if (sc->sc_sendad_errors == CARP_SENDAD_MAX_ERRORS) {
1056 				carp_suppress_preempt++;
1057 				if (carp_suppress_preempt == 1)
1058 					carp_send_ad_all();
1059 			}
1060 			sc->sc_sendad_success = 0;
1061 		} else {
1062 			if (sc->sc_sendad_errors >= CARP_SENDAD_MAX_ERRORS) {
1063 				if (++sc->sc_sendad_success >=
1064 				    CARP_SENDAD_MIN_SUCCESS) {
1065 					carp_suppress_preempt--;
1066 					sc->sc_sendad_errors = 0;
1067 				}
1068 			} else
1069 				sc->sc_sendad_errors = 0;
1070 		}
1071 	}
1072 #endif /* INET */
1073 #ifdef INET6
1074 	if (sc->sc_naddrs6) {
1075 		struct ip6_hdr *ip6;
1076 
1077 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
1078 		if (m == NULL) {
1079 			sc->sc_if.if_oerrors++;
1080 			CARP_STATINC(CARP_STAT_ONOMEM);
1081 			/* XXX maybe less ? */
1082 			goto retry_later;
1083 		}
1084 		MCLAIM(m, &carp_proto6_mowner_tx);
1085 		len = sizeof(*ip6) + sizeof(ch);
1086 		m->m_pkthdr.len = len;
1087 		m->m_pkthdr.rcvif = NULL;
1088 		m->m_len = len;
1089 		MH_ALIGN(m, m->m_len);
1090 		m->m_flags |= M_MCAST;
1091 		ip6 = mtod(m, struct ip6_hdr *);
1092 		memset(ip6, 0, sizeof(*ip6));
1093 		ip6->ip6_vfc |= IPV6_VERSION;
1094 		ip6->ip6_hlim = CARP_DFLTTL;
1095 		ip6->ip6_nxt = IPPROTO_CARP;
1096 
1097 		/* set the source address */
1098 		memset(&sa, 0, sizeof(sa));
1099 		sa.sa_family = AF_INET6;
1100 		ifa = ifaof_ifpforaddr(&sa, sc->sc_carpdev);
1101 		if (ifa == NULL)	/* This should never happen with IPv6 */
1102 			memset(&ip6->ip6_src, 0, sizeof(struct in6_addr));
1103 		else
1104 			bcopy(ifatoia6(ifa)->ia_addr.sin6_addr.s6_addr,
1105 			    &ip6->ip6_src, sizeof(struct in6_addr));
1106 		/* set the multicast destination */
1107 
1108 		ip6->ip6_dst.s6_addr16[0] = htons(0xff02);
1109 		ip6->ip6_dst.s6_addr8[15] = 0x12;
1110 		if (in6_setscope(&ip6->ip6_dst, sc->sc_carpdev, NULL) != 0) {
1111 			sc->sc_if.if_oerrors++;
1112 			m_freem(m);
1113 			CARP_LOG(sc, ("in6_setscope failed"));
1114 			goto retry_later;
1115 		}
1116 
1117 		ch_ptr = (struct carp_header *)(&ip6[1]);
1118 		memcpy(ch_ptr, &ch, sizeof(ch));
1119 		if (carp_prepare_ad(m, sc, ch_ptr))
1120 			goto retry_later;
1121 
1122 		m->m_data += sizeof(*ip6);
1123 		ch_ptr->carp_cksum = carp_cksum(m, len - sizeof(*ip6));
1124 		m->m_data -= sizeof(*ip6);
1125 
1126 		nanotime(&sc->sc_if.if_lastchange);
1127 		sc->sc_if.if_opackets++;
1128 		sc->sc_if.if_obytes += len;
1129 		CARP_STATINC(CARP_STAT_OPACKETS6);
1130 
1131 		error = ip6_output(m, NULL, NULL, 0, &sc->sc_im6o, NULL, NULL);
1132 		if (error) {
1133 			if (error == ENOBUFS)
1134 				CARP_STATINC(CARP_STAT_ONOMEM);
1135 			else
1136 				CARP_LOG(sc, ("ip6_output failed: %d", error));
1137 			sc->sc_if.if_oerrors++;
1138 			if (sc->sc_sendad_errors < INT_MAX)
1139 				sc->sc_sendad_errors++;
1140 			if (sc->sc_sendad_errors == CARP_SENDAD_MAX_ERRORS) {
1141 				carp_suppress_preempt++;
1142 				if (carp_suppress_preempt == 1)
1143 					carp_send_ad_all();
1144 			}
1145 			sc->sc_sendad_success = 0;
1146 		} else {
1147 			if (sc->sc_sendad_errors >= CARP_SENDAD_MAX_ERRORS) {
1148 				if (++sc->sc_sendad_success >=
1149 				    CARP_SENDAD_MIN_SUCCESS) {
1150 					carp_suppress_preempt--;
1151 					sc->sc_sendad_errors = 0;
1152 				}
1153 			} else
1154 				sc->sc_sendad_errors = 0;
1155 		}
1156 	}
1157 #endif /* INET6 */
1158 
1159 retry_later:
1160 	splx(s);
1161 	KERNEL_UNLOCK_ONE(NULL);
1162 	if (advbase != 255 || advskew != 255)
1163 		callout_schedule(&sc->sc_ad_tmo, tvtohz(&tv));
1164 }
1165 
1166 /*
1167  * Broadcast a gratuitous ARP request containing
1168  * the virtual router MAC address for each IP address
1169  * associated with the virtual router.
1170  */
1171 static void
1172 carp_send_arp(struct carp_softc *sc)
1173 {
1174 	struct ifaddr *ifa;
1175 	struct in_addr *in;
1176 	int s;
1177 
1178 	KERNEL_LOCK(1, NULL);
1179 	s = splsoftnet();
1180 	IFADDR_FOREACH(ifa, &sc->sc_if) {
1181 
1182 		if (ifa->ifa_addr->sa_family != AF_INET)
1183 			continue;
1184 
1185 		in = &ifatoia(ifa)->ia_addr.sin_addr;
1186 		arprequest(sc->sc_carpdev, in, in, CLLADDR(sc->sc_if.if_sadl));
1187 	}
1188 	splx(s);
1189 	KERNEL_UNLOCK_ONE(NULL);
1190 }
1191 
1192 #ifdef INET6
1193 static void
1194 carp_send_na(struct carp_softc *sc)
1195 {
1196 	struct ifaddr *ifa;
1197 	struct in6_addr *in6;
1198 	static struct in6_addr mcast = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
1199 	int s;
1200 
1201 	KERNEL_LOCK(1, NULL);
1202 	s = splsoftnet();
1203 
1204 	IFADDR_FOREACH(ifa, &sc->sc_if) {
1205 
1206 		if (ifa->ifa_addr->sa_family != AF_INET6)
1207 			continue;
1208 
1209 		in6 = &ifatoia6(ifa)->ia_addr.sin6_addr;
1210 		nd6_na_output(sc->sc_carpdev, &mcast, in6,
1211 		    ND_NA_FLAG_OVERRIDE, 1, NULL);
1212 	}
1213 	splx(s);
1214 	KERNEL_UNLOCK_ONE(NULL);
1215 }
1216 #endif /* INET6 */
1217 
1218 /*
1219  * Based on bridge_hash() in if_bridge.c
1220  */
1221 #define	mix(a,b,c) \
1222 	do {						\
1223 		a -= b; a -= c; a ^= (c >> 13);		\
1224 		b -= c; b -= a; b ^= (a << 8);		\
1225 		c -= a; c -= b; c ^= (b >> 13);		\
1226 		a -= b; a -= c; a ^= (c >> 12);		\
1227 		b -= c; b -= a; b ^= (a << 16);		\
1228 		c -= a; c -= b; c ^= (b >> 5);		\
1229 		a -= b; a -= c; a ^= (c >> 3);		\
1230 		b -= c; b -= a; b ^= (a << 10);		\
1231 		c -= a; c -= b; c ^= (b >> 15);		\
1232 	} while (0)
1233 
1234 static u_int32_t
1235 carp_hash(struct carp_softc *sc, u_char *src)
1236 {
1237 	u_int32_t a = 0x9e3779b9, b = sc->sc_hashkey[0], c = sc->sc_hashkey[1];
1238 
1239 	c += sc->sc_key[3] << 24;
1240 	c += sc->sc_key[2] << 16;
1241 	c += sc->sc_key[1] << 8;
1242 	c += sc->sc_key[0];
1243 	b += src[5] << 8;
1244 	b += src[4];
1245 	a += src[3] << 24;
1246 	a += src[2] << 16;
1247 	a += src[1] << 8;
1248 	a += src[0];
1249 
1250 	mix(a, b, c);
1251 	return (c);
1252 }
1253 
1254 static int
1255 carp_addrcount(struct carp_if *cif, struct in_ifaddr *ia, int type)
1256 {
1257 	struct carp_softc *vh;
1258 	struct ifaddr *ifa;
1259 	int count = 0;
1260 
1261 	TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list) {
1262 		if ((type == CARP_COUNT_RUNNING &&
1263 		    (vh->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) ==
1264 		    (IFF_UP|IFF_RUNNING)) ||
1265 		    (type == CARP_COUNT_MASTER && vh->sc_state == MASTER)) {
1266 			IFADDR_FOREACH(ifa, &vh->sc_if) {
1267 				if (ifa->ifa_addr->sa_family == AF_INET &&
1268 				    ia->ia_addr.sin_addr.s_addr ==
1269 				    ifatoia(ifa)->ia_addr.sin_addr.s_addr)
1270 					count++;
1271 			}
1272 		}
1273 	}
1274 	return (count);
1275 }
1276 
1277 int
1278 carp_iamatch(struct in_ifaddr *ia, u_char *src,
1279     u_int32_t *count, u_int32_t index)
1280 {
1281 	struct carp_softc *sc = ia->ia_ifp->if_softc;
1282 
1283 	if (carp_opts[CARPCTL_ARPBALANCE]) {
1284 		/*
1285 		 * We use the source ip to decide which virtual host should
1286 		 * handle the request. If we're master of that virtual host,
1287 		 * then we respond, otherwise, just drop the arp packet on
1288 		 * the floor.
1289 		 */
1290 
1291 		/* Count the elegible carp interfaces with this address */
1292 		if (*count == 0)
1293 			*count = carp_addrcount(
1294 			    (struct carp_if *)ia->ia_ifp->if_carpdev->if_carp,
1295 			    ia, CARP_COUNT_RUNNING);
1296 
1297 		/* This should never happen, but... */
1298 		if (*count == 0)
1299 			return (0);
1300 
1301 		if (carp_hash(sc, src) % *count == index - 1 &&
1302 		    sc->sc_state == MASTER) {
1303 			return (1);
1304 		}
1305 	} else {
1306 		if (sc->sc_state == MASTER)
1307 			return (1);
1308 	}
1309 
1310 	return (0);
1311 }
1312 
1313 #ifdef INET6
1314 struct ifaddr *
1315 carp_iamatch6(void *v, struct in6_addr *taddr)
1316 {
1317 	struct carp_if *cif = v;
1318 	struct carp_softc *vh;
1319 	struct ifaddr *ifa;
1320 
1321 	TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list) {
1322 		IFADDR_FOREACH(ifa, &vh->sc_if) {
1323 			if (IN6_ARE_ADDR_EQUAL(taddr,
1324 			    &ifatoia6(ifa)->ia_addr.sin6_addr) &&
1325 			    ((vh->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) ==
1326 			    (IFF_UP|IFF_RUNNING)) && vh->sc_state == MASTER)
1327 				return (ifa);
1328 		}
1329 	}
1330 
1331 	return (NULL);
1332 }
1333 #endif /* INET6 */
1334 
1335 struct ifnet *
1336 carp_ourether(void *v, struct ether_header *eh, u_char iftype, int src)
1337 {
1338 	struct carp_if *cif = (struct carp_if *)v;
1339 	struct carp_softc *vh;
1340 	u_int8_t *ena;
1341 
1342 	if (src)
1343 		ena = (u_int8_t *)&eh->ether_shost;
1344 	else
1345 		ena = (u_int8_t *)&eh->ether_dhost;
1346 
1347 	switch (iftype) {
1348 	case IFT_ETHER:
1349 	case IFT_FDDI:
1350 		if (ena[0] || ena[1] || ena[2] != 0x5e || ena[3] || ena[4] != 1)
1351 			return (NULL);
1352 		break;
1353 	case IFT_ISO88025:
1354 		if (ena[0] != 3 || ena[1] || ena[4] || ena[5])
1355 			return (NULL);
1356 		break;
1357 	default:
1358 		return (NULL);
1359 		break;
1360 	}
1361 
1362 	TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list)
1363 		if ((vh->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) ==
1364 		    (IFF_UP|IFF_RUNNING) && vh->sc_state == MASTER &&
1365 		    !memcmp(ena, CLLADDR(vh->sc_if.if_sadl),
1366 		    ETHER_ADDR_LEN)) {
1367 			return (&vh->sc_if);
1368 		    }
1369 
1370 	return (NULL);
1371 }
1372 
1373 int
1374 carp_input(struct mbuf *m, u_int8_t *shost, u_int8_t *dhost, u_int16_t etype)
1375 {
1376 	struct ether_header eh;
1377 	struct carp_if *cif = (struct carp_if *)m->m_pkthdr.rcvif->if_carp;
1378 	struct ifnet *ifp;
1379 
1380 	memcpy(&eh.ether_shost, shost, sizeof(eh.ether_shost));
1381 	memcpy(&eh.ether_dhost, dhost, sizeof(eh.ether_dhost));
1382 	eh.ether_type = etype;
1383 
1384 	if (m->m_flags & (M_BCAST|M_MCAST)) {
1385 		struct carp_softc *vh;
1386 		struct mbuf *m0;
1387 
1388 		/*
1389 		 * XXX Should really check the list of multicast addresses
1390 		 * for each CARP interface _before_ copying.
1391 		 */
1392 		TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list) {
1393 			m0 = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1394 			if (m0 == NULL)
1395 				continue;
1396 			m0->m_pkthdr.rcvif = &vh->sc_if;
1397 			ether_input(&vh->sc_if, m0);
1398 		}
1399 		return (1);
1400 	}
1401 
1402 	ifp = carp_ourether(cif, &eh, m->m_pkthdr.rcvif->if_type, 0);
1403 	if (ifp == NULL) {
1404 		return (1);
1405 	}
1406 
1407 	m->m_pkthdr.rcvif = ifp;
1408 
1409 	bpf_mtap(ifp, m);
1410 	ifp->if_ipackets++;
1411 	ether_input(ifp, m);
1412 	return (0);
1413 }
1414 
1415 static void
1416 carp_master_down(void *v)
1417 {
1418 	struct carp_softc *sc = v;
1419 
1420 	switch (sc->sc_state) {
1421 	case INIT:
1422 		printf("%s: master_down event in INIT state\n",
1423 		    sc->sc_if.if_xname);
1424 		break;
1425 	case MASTER:
1426 		break;
1427 	case BACKUP:
1428 		CARP_LOG(sc, ("INIT -> MASTER (preempting)"));
1429 		carp_set_state(sc, MASTER);
1430 		carp_send_ad(sc);
1431 		carp_send_arp(sc);
1432 #ifdef INET6
1433 		carp_send_na(sc);
1434 #endif /* INET6 */
1435 		carp_setrun(sc, 0);
1436 		carp_setroute(sc, RTM_ADD);
1437 		break;
1438 	}
1439 }
1440 
1441 /*
1442  * When in backup state, af indicates whether to reset the master down timer
1443  * for v4 or v6. If it's set to zero, reset the ones which are already pending.
1444  */
1445 static void
1446 carp_setrun(struct carp_softc *sc, sa_family_t af)
1447 {
1448 	struct timeval tv;
1449 
1450 	if (sc->sc_carpdev == NULL) {
1451 		sc->sc_if.if_flags &= ~IFF_RUNNING;
1452 		carp_set_state(sc, INIT);
1453 		return;
1454 	}
1455 
1456 	if (sc->sc_if.if_flags & IFF_UP && sc->sc_vhid > 0 &&
1457 	    (sc->sc_naddrs || sc->sc_naddrs6) && !sc->sc_suppress) {
1458 		sc->sc_if.if_flags |= IFF_RUNNING;
1459 	} else {
1460 		sc->sc_if.if_flags &= ~IFF_RUNNING;
1461 		carp_setroute(sc, RTM_DELETE);
1462 		return;
1463 	}
1464 
1465 	switch (sc->sc_state) {
1466 	case INIT:
1467 		carp_set_state(sc, BACKUP);
1468 		carp_setroute(sc, RTM_DELETE);
1469 		carp_setrun(sc, 0);
1470 		break;
1471 	case BACKUP:
1472 		callout_stop(&sc->sc_ad_tmo);
1473 		tv.tv_sec = 3 * sc->sc_advbase;
1474 		tv.tv_usec = sc->sc_advskew * 1000000 / 256;
1475 		switch (af) {
1476 #ifdef INET
1477 		case AF_INET:
1478 			callout_schedule(&sc->sc_md_tmo, tvtohz(&tv));
1479 			break;
1480 #endif /* INET */
1481 #ifdef INET6
1482 		case AF_INET6:
1483 			callout_schedule(&sc->sc_md6_tmo, tvtohz(&tv));
1484 			break;
1485 #endif /* INET6 */
1486 		default:
1487 			if (sc->sc_naddrs)
1488 				callout_schedule(&sc->sc_md_tmo, tvtohz(&tv));
1489 			if (sc->sc_naddrs6)
1490 				callout_schedule(&sc->sc_md6_tmo, tvtohz(&tv));
1491 			break;
1492 		}
1493 		break;
1494 	case MASTER:
1495 		tv.tv_sec = sc->sc_advbase;
1496 		tv.tv_usec = sc->sc_advskew * 1000000 / 256;
1497 		callout_schedule(&sc->sc_ad_tmo, tvtohz(&tv));
1498 		break;
1499 	}
1500 }
1501 
1502 static void
1503 carp_multicast_cleanup(struct carp_softc *sc)
1504 {
1505 	struct ip_moptions *imo = &sc->sc_imo;
1506 #ifdef INET6
1507 	struct ip6_moptions *im6o = &sc->sc_im6o;
1508 #endif
1509 	u_int16_t n = imo->imo_num_memberships;
1510 
1511 	/* Clean up our own multicast memberships */
1512 	while (n-- > 0) {
1513 		if (imo->imo_membership[n] != NULL) {
1514 			in_delmulti(imo->imo_membership[n]);
1515 			imo->imo_membership[n] = NULL;
1516 		}
1517 	}
1518 	imo->imo_num_memberships = 0;
1519 	imo->imo_multicast_ifp = NULL;
1520 
1521 #ifdef INET6
1522 	while (!LIST_EMPTY(&im6o->im6o_memberships)) {
1523 		struct in6_multi_mship *imm =
1524 		    LIST_FIRST(&im6o->im6o_memberships);
1525 
1526 		LIST_REMOVE(imm, i6mm_chain);
1527 		in6_leavegroup(imm);
1528 	}
1529 	im6o->im6o_multicast_ifp = NULL;
1530 #endif
1531 
1532 	/* And any other multicast memberships */
1533 	carp_ether_purgemulti(sc);
1534 }
1535 
1536 static int
1537 carp_set_ifp(struct carp_softc *sc, struct ifnet *ifp)
1538 {
1539 	struct carp_if *cif, *ncif = NULL;
1540 	struct carp_softc *vr, *after = NULL;
1541 	int myself = 0, error = 0;
1542 	int s;
1543 
1544 	if (ifp == sc->sc_carpdev)
1545 		return (0);
1546 
1547 	if (ifp != NULL) {
1548 		if ((ifp->if_flags & IFF_MULTICAST) == 0)
1549 			return (EADDRNOTAVAIL);
1550 
1551 		if (ifp->if_type == IFT_CARP)
1552 			return (EINVAL);
1553 
1554 		if (ifp->if_carp == NULL) {
1555 			ncif = malloc(sizeof(*cif), M_IFADDR, M_NOWAIT);
1556 			if (ncif == NULL)
1557 				return (ENOBUFS);
1558 			if ((error = ifpromisc(ifp, 1))) {
1559 				free(ncif, M_IFADDR);
1560 				return (error);
1561 			}
1562 
1563 			ncif->vhif_ifp = ifp;
1564 			TAILQ_INIT(&ncif->vhif_vrs);
1565 		} else {
1566 			cif = (struct carp_if *)ifp->if_carp;
1567 			TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list)
1568 				if (vr != sc && vr->sc_vhid == sc->sc_vhid)
1569 					return (EINVAL);
1570 		}
1571 
1572 		/* detach from old interface */
1573 		if (sc->sc_carpdev != NULL)
1574 			carpdetach(sc);
1575 
1576 		/* join multicast groups */
1577 		if (sc->sc_naddrs < 0 &&
1578 		    (error = carp_join_multicast(sc)) != 0) {
1579 			if (ncif != NULL)
1580 				free(ncif, M_IFADDR);
1581 			return (error);
1582 		}
1583 
1584 #ifdef INET6
1585 		if (sc->sc_naddrs6 < 0 &&
1586 		    (error = carp_join_multicast6(sc)) != 0) {
1587 			if (ncif != NULL)
1588 				free(ncif, M_IFADDR);
1589 			carp_multicast_cleanup(sc);
1590 			return (error);
1591 		}
1592 #endif
1593 
1594 		/* attach carp interface to physical interface */
1595 		if (ncif != NULL)
1596 			ifp->if_carp = (void *)ncif;
1597 		sc->sc_carpdev = ifp;
1598 		sc->sc_if.if_capabilities = ifp->if_capabilities &
1599 		             (IFCAP_TSOv4 | IFCAP_TSOv6 |
1600                              IFCAP_CSUM_IPv4_Tx|IFCAP_CSUM_IPv4_Rx|
1601                              IFCAP_CSUM_TCPv4_Tx|IFCAP_CSUM_TCPv4_Rx|
1602                              IFCAP_CSUM_UDPv4_Tx|IFCAP_CSUM_UDPv4_Rx|
1603                              IFCAP_CSUM_TCPv6_Tx|IFCAP_CSUM_TCPv6_Rx|
1604                              IFCAP_CSUM_UDPv6_Tx|IFCAP_CSUM_UDPv6_Rx);
1605 
1606 		cif = (struct carp_if *)ifp->if_carp;
1607 		TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list) {
1608 			if (vr == sc)
1609 				myself = 1;
1610 			if (vr->sc_vhid < sc->sc_vhid)
1611 				after = vr;
1612 		}
1613 
1614 		if (!myself) {
1615 			/* We're trying to keep things in order */
1616 			if (after == NULL) {
1617 				TAILQ_INSERT_TAIL(&cif->vhif_vrs, sc, sc_list);
1618 			} else {
1619 				TAILQ_INSERT_AFTER(&cif->vhif_vrs, after,
1620 				    sc, sc_list);
1621 			}
1622 			cif->vhif_nvrs++;
1623 		}
1624 		if (sc->sc_naddrs || sc->sc_naddrs6)
1625 			sc->sc_if.if_flags |= IFF_UP;
1626 		carp_set_enaddr(sc);
1627 		KERNEL_LOCK(1, NULL);
1628 		s = splnet();
1629 		/* XXX linkstatehooks establish */
1630 		carp_carpdev_state(ifp);
1631 		splx(s);
1632 		KERNEL_UNLOCK_ONE(NULL);
1633 	} else {
1634 		carpdetach(sc);
1635 		sc->sc_if.if_flags &= ~(IFF_UP|IFF_RUNNING);
1636 	}
1637 	return (0);
1638 }
1639 
1640 static void
1641 carp_set_enaddr(struct carp_softc *sc)
1642 {
1643 	uint8_t enaddr[ETHER_ADDR_LEN];
1644 	if (sc->sc_carpdev && sc->sc_carpdev->if_type == IFT_ISO88025) {
1645 		enaddr[0] = 3;
1646 		enaddr[1] = 0;
1647 		enaddr[2] = 0x40 >> (sc->sc_vhid - 1);
1648 		enaddr[3] = 0x40000 >> (sc->sc_vhid - 1);
1649 		enaddr[4] = 0;
1650 		enaddr[5] = 0;
1651 	} else {
1652 		enaddr[0] = 0;
1653 		enaddr[1] = 0;
1654 		enaddr[2] = 0x5e;
1655 		enaddr[3] = 0;
1656 		enaddr[4] = 1;
1657 		enaddr[5] = sc->sc_vhid;
1658 	}
1659 	if_set_sadl(&sc->sc_if, enaddr, sizeof(enaddr), false);
1660 }
1661 
1662 #if 0
1663 static void
1664 carp_addr_updated(void *v)
1665 {
1666 	struct carp_softc *sc = (struct carp_softc *) v;
1667 	struct ifaddr *ifa;
1668 	int new_naddrs = 0, new_naddrs6 = 0;
1669 
1670 	IFADDR_FOREACH(ifa, &sc->sc_if) {
1671 		if (ifa->ifa_addr->sa_family == AF_INET)
1672 			new_naddrs++;
1673 		else if (ifa->ifa_addr->sa_family == AF_INET6)
1674 			new_naddrs6++;
1675 	}
1676 
1677 	/* Handle a callback after SIOCDIFADDR */
1678 	if (new_naddrs < sc->sc_naddrs || new_naddrs6 < sc->sc_naddrs6) {
1679 		struct in_addr mc_addr;
1680 
1681 		sc->sc_naddrs = new_naddrs;
1682 		sc->sc_naddrs6 = new_naddrs6;
1683 
1684 		/* Re-establish multicast membership removed by in_control */
1685 		mc_addr.s_addr = INADDR_CARP_GROUP;
1686 		if (!in_multi_group(mc_addr, &sc->sc_if, 0)) {
1687 			memset(&sc->sc_imo, 0, sizeof(sc->sc_imo));
1688 
1689 			if (sc->sc_carpdev != NULL && sc->sc_naddrs > 0)
1690 				carp_join_multicast(sc);
1691 		}
1692 
1693 		if (sc->sc_naddrs == 0 && sc->sc_naddrs6 == 0) {
1694 			sc->sc_if.if_flags &= ~IFF_UP;
1695 			carp_set_state(sc, INIT);
1696 		} else
1697 			carp_hmac_prepare(sc);
1698 	}
1699 
1700 	carp_setrun(sc, 0);
1701 }
1702 #endif
1703 
1704 static int
1705 carp_set_addr(struct carp_softc *sc, struct sockaddr_in *sin)
1706 {
1707 	struct ifnet *ifp = sc->sc_carpdev;
1708 	struct in_ifaddr *ia, *ia_if;
1709 	int error = 0;
1710 
1711 	if (sin->sin_addr.s_addr == 0) {
1712 		if (!(sc->sc_if.if_flags & IFF_UP))
1713 			carp_set_state(sc, INIT);
1714 		if (sc->sc_naddrs)
1715 			sc->sc_if.if_flags |= IFF_UP;
1716 		carp_setrun(sc, 0);
1717 		return (0);
1718 	}
1719 
1720 	/* we have to do this by hand to ensure we don't match on ourselves */
1721 	ia_if = NULL;
1722 	for (ia = TAILQ_FIRST(&in_ifaddrhead); ia;
1723 	    ia = TAILQ_NEXT(ia, ia_list)) {
1724 
1725 		/* and, yeah, we need a multicast-capable iface too */
1726 		if (ia->ia_ifp != &sc->sc_if &&
1727 		    ia->ia_ifp->if_type != IFT_CARP &&
1728 		    (ia->ia_ifp->if_flags & IFF_MULTICAST) &&
1729 		    (sin->sin_addr.s_addr & ia->ia_subnetmask) ==
1730 		    ia->ia_subnet) {
1731 			if (!ia_if)
1732 				ia_if = ia;
1733 		}
1734 	}
1735 
1736 	if (ia_if) {
1737 		ia = ia_if;
1738 		if (ifp) {
1739 			if (ifp != ia->ia_ifp)
1740 				return (EADDRNOTAVAIL);
1741 		} else {
1742 			ifp = ia->ia_ifp;
1743 		}
1744 	}
1745 
1746 	if ((error = carp_set_ifp(sc, ifp)))
1747 		return (error);
1748 
1749 	if (sc->sc_carpdev == NULL)
1750 		return (EADDRNOTAVAIL);
1751 
1752 	if (sc->sc_naddrs == 0 && (error = carp_join_multicast(sc)) != 0)
1753 		return (error);
1754 
1755 	sc->sc_naddrs++;
1756 	if (sc->sc_carpdev != NULL)
1757 		sc->sc_if.if_flags |= IFF_UP;
1758 
1759 	carp_set_state(sc, INIT);
1760 	carp_setrun(sc, 0);
1761 
1762 	/*
1763 	 * Hook if_addrhooks so that we get a callback after in_ifinit has run,
1764 	 * to correct any inappropriate routes that it inserted.
1765 	 */
1766 	if (sc->ah_cookie == 0) {
1767 		/* XXX link address hook */
1768 	}
1769 
1770 	return (0);
1771 }
1772 
1773 static int
1774 carp_join_multicast(struct carp_softc *sc)
1775 {
1776 	struct ip_moptions *imo = &sc->sc_imo, tmpimo;
1777 	struct in_addr addr;
1778 
1779 	memset(&tmpimo, 0, sizeof(tmpimo));
1780 	addr.s_addr = INADDR_CARP_GROUP;
1781 	if ((tmpimo.imo_membership[0] =
1782 	    in_addmulti(&addr, &sc->sc_if)) == NULL) {
1783 		return (ENOBUFS);
1784 	}
1785 
1786 	imo->imo_membership[0] = tmpimo.imo_membership[0];
1787 	imo->imo_num_memberships = 1;
1788 	imo->imo_multicast_ifp = &sc->sc_if;
1789 	imo->imo_multicast_ttl = CARP_DFLTTL;
1790 	imo->imo_multicast_loop = 0;
1791 	return (0);
1792 }
1793 
1794 
1795 #ifdef INET6
1796 static int
1797 carp_set_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
1798 {
1799 	struct ifnet *ifp = sc->sc_carpdev;
1800 	struct in6_ifaddr *ia, *ia_if;
1801 	int error = 0;
1802 
1803 	if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1804 		if (!(sc->sc_if.if_flags & IFF_UP))
1805 			carp_set_state(sc, INIT);
1806 		if (sc->sc_naddrs6)
1807 			sc->sc_if.if_flags |= IFF_UP;
1808 		carp_setrun(sc, 0);
1809 		return (0);
1810 	}
1811 
1812 	/* we have to do this by hand to ensure we don't match on ourselves */
1813 	ia_if = NULL;
1814 	for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
1815 		int i;
1816 
1817 		for (i = 0; i < 4; i++) {
1818 			if ((sin6->sin6_addr.s6_addr32[i] &
1819 			    ia->ia_prefixmask.sin6_addr.s6_addr32[i]) !=
1820 			    (ia->ia_addr.sin6_addr.s6_addr32[i] &
1821 			    ia->ia_prefixmask.sin6_addr.s6_addr32[i]))
1822 				break;
1823 		}
1824 		/* and, yeah, we need a multicast-capable iface too */
1825 		if (ia->ia_ifp != &sc->sc_if &&
1826 		    ia->ia_ifp->if_type != IFT_CARP &&
1827 		    (ia->ia_ifp->if_flags & IFF_MULTICAST) &&
1828 		    (i == 4)) {
1829 			if (!ia_if)
1830 				ia_if = ia;
1831 		}
1832 	}
1833 
1834 	if (ia_if) {
1835 		ia = ia_if;
1836 		if (sc->sc_carpdev) {
1837 			if (sc->sc_carpdev != ia->ia_ifp)
1838 				return (EADDRNOTAVAIL);
1839 		} else {
1840 			ifp = ia->ia_ifp;
1841 		}
1842 	}
1843 
1844 	if ((error = carp_set_ifp(sc, ifp)))
1845 		return (error);
1846 
1847 	if (sc->sc_carpdev == NULL)
1848 		return (EADDRNOTAVAIL);
1849 
1850 	if (sc->sc_naddrs6 == 0 && (error = carp_join_multicast6(sc)) != 0)
1851 		return (error);
1852 
1853 	sc->sc_naddrs6++;
1854 	if (sc->sc_carpdev != NULL)
1855 		sc->sc_if.if_flags |= IFF_UP;
1856 	carp_set_state(sc, INIT);
1857 	carp_setrun(sc, 0);
1858 
1859 	return (0);
1860 }
1861 
1862 static int
1863 carp_join_multicast6(struct carp_softc *sc)
1864 {
1865 	struct in6_multi_mship *imm, *imm2;
1866 	struct ip6_moptions *im6o = &sc->sc_im6o;
1867 	struct sockaddr_in6 addr6;
1868 	int error;
1869 
1870 	/* Join IPv6 CARP multicast group */
1871 	memset(&addr6, 0, sizeof(addr6));
1872 	addr6.sin6_family = AF_INET6;
1873 	addr6.sin6_len = sizeof(addr6);
1874 	addr6.sin6_addr.s6_addr16[0] = htons(0xff02);
1875 	addr6.sin6_addr.s6_addr16[1] = htons(sc->sc_if.if_index);
1876 	addr6.sin6_addr.s6_addr8[15] = 0x12;
1877 	if ((imm = in6_joingroup(&sc->sc_if,
1878 	    &addr6.sin6_addr, &error, 0)) == NULL) {
1879 		return (error);
1880 	}
1881 	/* join solicited multicast address */
1882 	memset(&addr6.sin6_addr, 0, sizeof(addr6.sin6_addr));
1883 	addr6.sin6_addr.s6_addr16[0] = htons(0xff02);
1884 	addr6.sin6_addr.s6_addr16[1] = htons(sc->sc_if.if_index);
1885 	addr6.sin6_addr.s6_addr32[1] = 0;
1886 	addr6.sin6_addr.s6_addr32[2] = htonl(1);
1887 	addr6.sin6_addr.s6_addr32[3] = 0;
1888 	addr6.sin6_addr.s6_addr8[12] = 0xff;
1889 	if ((imm2 = in6_joingroup(&sc->sc_if,
1890 	    &addr6.sin6_addr, &error, 0)) == NULL) {
1891 		in6_leavegroup(imm);
1892 		return (error);
1893 	}
1894 
1895 	/* apply v6 multicast membership */
1896 	im6o->im6o_multicast_ifp = &sc->sc_if;
1897 	if (imm)
1898 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm,
1899 		    i6mm_chain);
1900 	if (imm2)
1901 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm2,
1902 		    i6mm_chain);
1903 
1904 	return (0);
1905 }
1906 
1907 #endif /* INET6 */
1908 
1909 static int
1910 carp_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1911 {
1912 	struct lwp *l = curlwp;		/* XXX */
1913 	struct carp_softc *sc = ifp->if_softc, *vr;
1914 	struct carpreq carpr;
1915 	struct ifaddr *ifa;
1916 	struct ifreq *ifr;
1917 	struct ifnet *cdev = NULL;
1918 	int error = 0;
1919 
1920 	ifa = (struct ifaddr *)data;
1921 	ifr = (struct ifreq *)data;
1922 
1923 	switch (cmd) {
1924 	case SIOCINITIFADDR:
1925 		switch (ifa->ifa_addr->sa_family) {
1926 #ifdef INET
1927 		case AF_INET:
1928 			sc->sc_if.if_flags |= IFF_UP;
1929 			memcpy(ifa->ifa_dstaddr, ifa->ifa_addr,
1930 			    sizeof(struct sockaddr));
1931 			error = carp_set_addr(sc, satosin(ifa->ifa_addr));
1932 			break;
1933 #endif /* INET */
1934 #ifdef INET6
1935 		case AF_INET6:
1936 			sc->sc_if.if_flags|= IFF_UP;
1937 			error = carp_set_addr6(sc, satosin6(ifa->ifa_addr));
1938 			break;
1939 #endif /* INET6 */
1940 		default:
1941 			error = EAFNOSUPPORT;
1942 			break;
1943 		}
1944 		break;
1945 
1946 	case SIOCSIFFLAGS:
1947 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1948 			break;
1949 		if (sc->sc_state != INIT && !(ifr->ifr_flags & IFF_UP)) {
1950 			callout_stop(&sc->sc_ad_tmo);
1951 			callout_stop(&sc->sc_md_tmo);
1952 			callout_stop(&sc->sc_md6_tmo);
1953 			if (sc->sc_state == MASTER) {
1954 				/* we need the interface up to bow out */
1955 				sc->sc_if.if_flags |= IFF_UP;
1956 				sc->sc_bow_out = 1;
1957 				carp_send_ad(sc);
1958 			}
1959 			sc->sc_if.if_flags &= ~IFF_UP;
1960 			carp_set_state(sc, INIT);
1961 			carp_setrun(sc, 0);
1962 		} else if (sc->sc_state == INIT && (ifr->ifr_flags & IFF_UP)) {
1963 			sc->sc_if.if_flags |= IFF_UP;
1964 			carp_setrun(sc, 0);
1965 		}
1966 		break;
1967 
1968 	case SIOCSVH:
1969 		if (l == NULL)
1970 			break;
1971 		if ((error = kauth_authorize_network(l->l_cred,
1972 		    KAUTH_NETWORK_INTERFACE,
1973 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
1974 		    NULL)) != 0)
1975 			break;
1976 		if ((error = copyin(ifr->ifr_data, &carpr, sizeof carpr)))
1977 			break;
1978 		error = 1;
1979 		if (carpr.carpr_carpdev[0] != '\0' &&
1980 		    (cdev = ifunit(carpr.carpr_carpdev)) == NULL)
1981 			return (EINVAL);
1982 		if ((error = carp_set_ifp(sc, cdev)))
1983 			return (error);
1984 		if (sc->sc_state != INIT && carpr.carpr_state != sc->sc_state) {
1985 			switch (carpr.carpr_state) {
1986 			case BACKUP:
1987 				callout_stop(&sc->sc_ad_tmo);
1988 				carp_set_state(sc, BACKUP);
1989 				carp_setrun(sc, 0);
1990 				carp_setroute(sc, RTM_DELETE);
1991 				break;
1992 			case MASTER:
1993 				carp_master_down(sc);
1994 				break;
1995 			default:
1996 				break;
1997 			}
1998 		}
1999 		if (carpr.carpr_vhid > 0) {
2000 			if (carpr.carpr_vhid > 255) {
2001 				error = EINVAL;
2002 				break;
2003 			}
2004 			if (sc->sc_carpdev) {
2005 				struct carp_if *cif;
2006 				cif = (struct carp_if *)sc->sc_carpdev->if_carp;
2007 				TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list)
2008 					if (vr != sc &&
2009 					    vr->sc_vhid == carpr.carpr_vhid)
2010 						return (EINVAL);
2011 			}
2012 			sc->sc_vhid = carpr.carpr_vhid;
2013 			carp_set_enaddr(sc);
2014 			carp_set_state(sc, INIT);
2015 			error--;
2016 		}
2017 		if (carpr.carpr_advbase > 0 || carpr.carpr_advskew > 0) {
2018 			if (carpr.carpr_advskew > 254) {
2019 				error = EINVAL;
2020 				break;
2021 			}
2022 			if (carpr.carpr_advbase > 255) {
2023 				error = EINVAL;
2024 				break;
2025 			}
2026 			sc->sc_advbase = carpr.carpr_advbase;
2027 			sc->sc_advskew = carpr.carpr_advskew;
2028 			error--;
2029 		}
2030 		memcpy(sc->sc_key, carpr.carpr_key, sizeof(sc->sc_key));
2031 		if (error > 0)
2032 			error = EINVAL;
2033 		else {
2034 			error = 0;
2035 			carp_setrun(sc, 0);
2036 		}
2037 		break;
2038 
2039 	case SIOCGVH:
2040 		memset(&carpr, 0, sizeof(carpr));
2041 		if (sc->sc_carpdev != NULL)
2042 			strlcpy(carpr.carpr_carpdev, sc->sc_carpdev->if_xname,
2043 			    IFNAMSIZ);
2044 		carpr.carpr_state = sc->sc_state;
2045 		carpr.carpr_vhid = sc->sc_vhid;
2046 		carpr.carpr_advbase = sc->sc_advbase;
2047 		carpr.carpr_advskew = sc->sc_advskew;
2048 
2049 		if ((l != NULL) && (error = kauth_authorize_network(l->l_cred,
2050 		    KAUTH_NETWORK_INTERFACE,
2051 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
2052 		    NULL)) == 0)
2053 			memcpy(carpr.carpr_key, sc->sc_key,
2054 			    sizeof(carpr.carpr_key));
2055 		error = copyout(&carpr, ifr->ifr_data, sizeof(carpr));
2056 		break;
2057 
2058 	case SIOCADDMULTI:
2059 		error = carp_ether_addmulti(sc, ifr);
2060 		break;
2061 
2062 	case SIOCDELMULTI:
2063 		error = carp_ether_delmulti(sc, ifr);
2064 		break;
2065 
2066 	case SIOCSIFCAP:
2067 		if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
2068 			error = 0;
2069 		break;
2070 
2071 	default:
2072 		error = ether_ioctl(ifp, cmd, data);
2073 	}
2074 
2075 	carp_hmac_prepare(sc);
2076 	return (error);
2077 }
2078 
2079 
2080 /*
2081  * Start output on carp interface. This function should never be called.
2082  */
2083 static void
2084 carp_start(struct ifnet *ifp)
2085 {
2086 #ifdef DEBUG
2087 	printf("%s: start called\n", ifp->if_xname);
2088 #endif
2089 }
2090 
2091 int
2092 carp_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *sa,
2093     struct rtentry *rt)
2094 {
2095 	struct carp_softc *sc = ((struct carp_softc *)ifp->if_softc);
2096 	KASSERT(KERNEL_LOCKED_P());
2097 
2098 	if (sc->sc_carpdev != NULL && sc->sc_state == MASTER) {
2099 		return (sc->sc_carpdev->if_output(ifp, m, sa, rt));
2100 	} else {
2101 		m_freem(m);
2102 		return (ENETUNREACH);
2103 	}
2104 }
2105 
2106 static void
2107 carp_set_state(struct carp_softc *sc, int state)
2108 {
2109 	static const char *carp_states[] = { CARP_STATES };
2110 	if (sc->sc_state == state)
2111 		return;
2112 
2113 	CARP_LOG(sc, ("state transition from: %s -> to: %s", carp_states[sc->sc_state], carp_states[state]));
2114 
2115 	sc->sc_state = state;
2116 	switch (state) {
2117 	case BACKUP:
2118 		sc->sc_if.if_link_state = LINK_STATE_DOWN;
2119 		break;
2120 	case MASTER:
2121 		sc->sc_if.if_link_state = LINK_STATE_UP;
2122 		break;
2123 	default:
2124 		sc->sc_if.if_link_state = LINK_STATE_UNKNOWN;
2125 		break;
2126 	}
2127 	rt_ifmsg(&sc->sc_if);
2128 }
2129 
2130 void
2131 carp_carpdev_state(void *v)
2132 {
2133 	struct carp_if *cif;
2134 	struct carp_softc *sc;
2135 	struct ifnet *ifp = v;
2136 
2137 	if (ifp->if_type == IFT_CARP)
2138 		return;
2139 
2140 	cif = (struct carp_if *)ifp->if_carp;
2141 
2142 	TAILQ_FOREACH(sc, &cif->vhif_vrs, sc_list) {
2143 		int suppressed = sc->sc_suppress;
2144 
2145 		if (sc->sc_carpdev->if_link_state == LINK_STATE_DOWN ||
2146 		    !(sc->sc_carpdev->if_flags & IFF_UP)) {
2147 			sc->sc_if.if_flags &= ~IFF_RUNNING;
2148 			callout_stop(&sc->sc_ad_tmo);
2149 			callout_stop(&sc->sc_md_tmo);
2150 			callout_stop(&sc->sc_md6_tmo);
2151 			carp_set_state(sc, INIT);
2152 			sc->sc_suppress = 1;
2153 			carp_setrun(sc, 0);
2154 			if (!suppressed) {
2155 				carp_suppress_preempt++;
2156 				if (carp_suppress_preempt == 1)
2157 					carp_send_ad_all();
2158 			}
2159 		} else {
2160 			carp_set_state(sc, INIT);
2161 			sc->sc_suppress = 0;
2162 			carp_setrun(sc, 0);
2163 			if (suppressed)
2164 				carp_suppress_preempt--;
2165 		}
2166 	}
2167 }
2168 
2169 static int
2170 carp_ether_addmulti(struct carp_softc *sc, struct ifreq *ifr)
2171 {
2172 	const struct sockaddr *sa = ifreq_getaddr(SIOCADDMULTI, ifr);
2173 	struct ifnet *ifp;
2174 	struct carp_mc_entry *mc;
2175 	u_int8_t addrlo[ETHER_ADDR_LEN], addrhi[ETHER_ADDR_LEN];
2176 	int error;
2177 
2178 	ifp = sc->sc_carpdev;
2179 	if (ifp == NULL)
2180 		return (EINVAL);
2181 
2182 	error = ether_addmulti(sa, &sc->sc_ac);
2183 	if (error != ENETRESET)
2184 		return (error);
2185 
2186 	/*
2187 	 * This is new multicast address.  We have to tell parent
2188 	 * about it.  Also, remember this multicast address so that
2189 	 * we can delete them on unconfigure.
2190 	 */
2191 	mc = malloc(sizeof(struct carp_mc_entry), M_DEVBUF, M_NOWAIT);
2192 	if (mc == NULL) {
2193 		error = ENOMEM;
2194 		goto alloc_failed;
2195 	}
2196 
2197 	/*
2198 	 * As ether_addmulti() returns ENETRESET, following two
2199 	 * statement shouldn't fail.
2200 	 */
2201 	(void)ether_multiaddr(sa, addrlo, addrhi);
2202 	ETHER_LOOKUP_MULTI(addrlo, addrhi, &sc->sc_ac, mc->mc_enm);
2203 	memcpy(&mc->mc_addr, sa, sa->sa_len);
2204 	LIST_INSERT_HEAD(&sc->carp_mc_listhead, mc, mc_entries);
2205 
2206 	error = if_mcast_op(ifp, SIOCADDMULTI, sa);
2207 	if (error != 0)
2208 		goto ioctl_failed;
2209 
2210 	return (error);
2211 
2212  ioctl_failed:
2213 	LIST_REMOVE(mc, mc_entries);
2214 	free(mc, M_DEVBUF);
2215  alloc_failed:
2216 	(void)ether_delmulti(sa, &sc->sc_ac);
2217 
2218 	return (error);
2219 }
2220 
2221 static int
2222 carp_ether_delmulti(struct carp_softc *sc, struct ifreq *ifr)
2223 {
2224 	const struct sockaddr *sa = ifreq_getaddr(SIOCDELMULTI, ifr);
2225 	struct ifnet *ifp;
2226 	struct ether_multi *enm;
2227 	struct carp_mc_entry *mc;
2228 	u_int8_t addrlo[ETHER_ADDR_LEN], addrhi[ETHER_ADDR_LEN];
2229 	int error;
2230 
2231 	ifp = sc->sc_carpdev;
2232 	if (ifp == NULL)
2233 		return (EINVAL);
2234 
2235 	/*
2236 	 * Find a key to lookup carp_mc_entry.  We have to do this
2237 	 * before calling ether_delmulti for obvious reason.
2238 	 */
2239 	if ((error = ether_multiaddr(sa, addrlo, addrhi)) != 0)
2240 		return (error);
2241 	ETHER_LOOKUP_MULTI(addrlo, addrhi, &sc->sc_ac, enm);
2242 	if (enm == NULL)
2243 		return (EINVAL);
2244 
2245 	LIST_FOREACH(mc, &sc->carp_mc_listhead, mc_entries)
2246 		if (mc->mc_enm == enm)
2247 			break;
2248 
2249 	/* We won't delete entries we didn't add */
2250 	if (mc == NULL)
2251 		return (EINVAL);
2252 
2253 	error = ether_delmulti(sa, &sc->sc_ac);
2254 	if (error != ENETRESET)
2255 		return (error);
2256 
2257 	/* We no longer use this multicast address.  Tell parent so. */
2258 	error = if_mcast_op(ifp, SIOCDELMULTI, sa);
2259 	if (error == 0) {
2260 		/* And forget about this address. */
2261 		LIST_REMOVE(mc, mc_entries);
2262 		free(mc, M_DEVBUF);
2263 	} else
2264 		(void)ether_addmulti(sa, &sc->sc_ac);
2265 	return (error);
2266 }
2267 
2268 /*
2269  * Delete any multicast address we have asked to add from parent
2270  * interface.  Called when the carp is being unconfigured.
2271  */
2272 static void
2273 carp_ether_purgemulti(struct carp_softc *sc)
2274 {
2275 	struct ifnet *ifp = sc->sc_carpdev;		/* Parent. */
2276 	struct carp_mc_entry *mc;
2277 
2278 	if (ifp == NULL)
2279 		return;
2280 
2281 	while ((mc = LIST_FIRST(&sc->carp_mc_listhead)) != NULL) {
2282 		(void)if_mcast_op(ifp, SIOCDELMULTI, sstosa(&mc->mc_addr));
2283 		LIST_REMOVE(mc, mc_entries);
2284 		free(mc, M_DEVBUF);
2285 	}
2286 }
2287 
2288 static int
2289 sysctl_net_inet_carp_stats(SYSCTLFN_ARGS)
2290 {
2291 
2292 	return (NETSTAT_SYSCTL(carpstat_percpu, CARP_NSTATS));
2293 }
2294 
2295 void
2296 carp_init(void)
2297 {
2298 
2299 	sysctl_net_inet_carp_setup(NULL);
2300 #ifdef MBUFTRACE
2301 	MOWNER_ATTACH(&carp_proto_mowner_rx);
2302 	MOWNER_ATTACH(&carp_proto_mowner_tx);
2303 	MOWNER_ATTACH(&carp_proto6_mowner_rx);
2304 	MOWNER_ATTACH(&carp_proto6_mowner_tx);
2305 #endif
2306 }
2307 
2308 static void
2309 sysctl_net_inet_carp_setup(struct sysctllog **clog)
2310 {
2311 
2312 	sysctl_createv(clog, 0, NULL, NULL,
2313 		       CTLFLAG_PERMANENT,
2314 		       CTLTYPE_NODE, "inet", NULL,
2315 		       NULL, 0, NULL, 0,
2316 		       CTL_NET, PF_INET, CTL_EOL);
2317 	sysctl_createv(clog, 0, NULL, NULL,
2318 		       CTLFLAG_PERMANENT,
2319 		       CTLTYPE_NODE, "carp",
2320 		       SYSCTL_DESCR("CARP related settings"),
2321 		       NULL, 0, NULL, 0,
2322 		       CTL_NET, PF_INET, IPPROTO_CARP, CTL_EOL);
2323 
2324 	sysctl_createv(clog, 0, NULL, NULL,
2325 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2326 		       CTLTYPE_INT, "preempt",
2327 		       SYSCTL_DESCR("Enable CARP Preempt"),
2328 		       NULL, 0, &carp_opts[CARPCTL_PREEMPT], 0,
2329 		       CTL_NET, PF_INET, IPPROTO_CARP,
2330 		       CTL_CREATE, CTL_EOL);
2331 	sysctl_createv(clog, 0, NULL, NULL,
2332 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2333 		       CTLTYPE_INT, "arpbalance",
2334 		       SYSCTL_DESCR("Enable ARP balancing"),
2335 		       NULL, 0, &carp_opts[CARPCTL_ARPBALANCE], 0,
2336 		       CTL_NET, PF_INET, IPPROTO_CARP,
2337 		       CTL_CREATE, CTL_EOL);
2338 	sysctl_createv(clog, 0, NULL, NULL,
2339 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2340 		       CTLTYPE_INT, "allow",
2341 		       SYSCTL_DESCR("Enable CARP"),
2342 		       NULL, 0, &carp_opts[CARPCTL_ALLOW], 0,
2343 		       CTL_NET, PF_INET, IPPROTO_CARP,
2344 		       CTL_CREATE, CTL_EOL);
2345 	sysctl_createv(clog, 0, NULL, NULL,
2346 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2347 		       CTLTYPE_INT, "log",
2348 		       SYSCTL_DESCR("CARP logging"),
2349 		       NULL, 0, &carp_opts[CARPCTL_LOG], 0,
2350 		       CTL_NET, PF_INET, IPPROTO_CARP,
2351 		       CTL_CREATE, CTL_EOL);
2352 	sysctl_createv(clog, 0, NULL, NULL,
2353 		       CTLFLAG_PERMANENT,
2354 		       CTLTYPE_STRUCT, "stats",
2355 		       SYSCTL_DESCR("CARP statistics"),
2356 		       sysctl_net_inet_carp_stats, 0, NULL, 0,
2357 		       CTL_NET, PF_INET, IPPROTO_CARP, CARPCTL_STATS,
2358 		       CTL_EOL);
2359 }
2360