The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_carp.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2002 Michael Shalayeff.
    5  * Copyright (c) 2003 Ryan McBride.
    6  * Copyright (c) 2011 Gleb Smirnoff <glebius@FreeBSD.org>
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  *
   18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   21  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
   22  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
   23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
   24  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   26  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
   27  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
   28  * THE POSSIBILITY OF SUCH DAMAGE.
   29  */
   30 
   31 #include <sys/cdefs.h>
   32 __FBSDID("$FreeBSD: releng/12.0/sys/netinet/ip_carp.c 340109 2018-11-04 06:25:07Z bz $");
   33 
   34 #include "opt_bpf.h"
   35 #include "opt_inet.h"
   36 #include "opt_inet6.h"
   37 
   38 #include <sys/param.h>
   39 #include <sys/systm.h>
   40 #include <sys/bus.h>
   41 #include <sys/jail.h>
   42 #include <sys/kernel.h>
   43 #include <sys/limits.h>
   44 #include <sys/malloc.h>
   45 #include <sys/mbuf.h>
   46 #include <sys/module.h>
   47 #include <sys/priv.h>
   48 #include <sys/proc.h>
   49 #include <sys/protosw.h>
   50 #include <sys/socket.h>
   51 #include <sys/sockio.h>
   52 #include <sys/sysctl.h>
   53 #include <sys/syslog.h>
   54 #include <sys/taskqueue.h>
   55 #include <sys/counter.h>
   56 
   57 #include <net/ethernet.h>
   58 #include <net/if.h>
   59 #include <net/if_var.h>
   60 #include <net/if_dl.h>
   61 #include <net/if_llatbl.h>
   62 #include <net/if_types.h>
   63 #include <net/route.h>
   64 #include <net/vnet.h>
   65 
   66 #if defined(INET) || defined(INET6)
   67 #include <netinet/in.h>
   68 #include <netinet/in_var.h>
   69 #include <netinet/ip_carp.h>
   70 #include <netinet/ip.h>
   71 #include <machine/in_cksum.h>
   72 #endif
   73 #ifdef INET
   74 #include <netinet/ip_var.h>
   75 #include <netinet/if_ether.h>
   76 #endif
   77 
   78 #ifdef INET6
   79 #include <netinet/icmp6.h>
   80 #include <netinet/ip6.h>
   81 #include <netinet6/in6_var.h>
   82 #include <netinet6/ip6_var.h>
   83 #include <netinet6/scope6_var.h>
   84 #include <netinet6/nd6.h>
   85 #endif
   86 
   87 #include <crypto/sha1.h>
   88 
   89 static MALLOC_DEFINE(M_CARP, "CARP", "CARP addresses");
   90 
   91 struct carp_softc {
   92         struct ifnet            *sc_carpdev;    /* Pointer to parent ifnet. */
   93         struct ifaddr           **sc_ifas;      /* Our ifaddrs. */
   94         struct sockaddr_dl      sc_addr;        /* Our link level address. */
   95         struct callout          sc_ad_tmo;      /* Advertising timeout. */
   96 #ifdef INET
   97         struct callout          sc_md_tmo;      /* Master down timeout. */
   98 #endif
   99 #ifdef INET6
  100         struct callout          sc_md6_tmo;     /* XXX: Master down timeout. */
  101 #endif
  102         struct mtx              sc_mtx;
  103 
  104         int                     sc_vhid;
  105         int                     sc_advskew;
  106         int                     sc_advbase;
  107 
  108         int                     sc_naddrs;
  109         int                     sc_naddrs6;
  110         int                     sc_ifasiz;
  111         enum { INIT = 0, BACKUP, MASTER }       sc_state;
  112         int                     sc_suppress;
  113         int                     sc_sendad_errors;
  114 #define CARP_SENDAD_MAX_ERRORS  3
  115         int                     sc_sendad_success;
  116 #define CARP_SENDAD_MIN_SUCCESS 3
  117 
  118         int                     sc_init_counter;
  119         uint64_t                sc_counter;
  120 
  121         /* authentication */
  122 #define CARP_HMAC_PAD   64
  123         unsigned char sc_key[CARP_KEY_LEN];
  124         unsigned char sc_pad[CARP_HMAC_PAD];
  125         SHA1_CTX sc_sha1;
  126 
  127         TAILQ_ENTRY(carp_softc) sc_list;        /* On the carp_if list. */
  128         LIST_ENTRY(carp_softc)  sc_next;        /* On the global list. */
  129 };
  130 
  131 struct carp_if {
  132 #ifdef INET
  133         int     cif_naddrs;
  134 #endif
  135 #ifdef INET6
  136         int     cif_naddrs6;
  137 #endif
  138         TAILQ_HEAD(, carp_softc) cif_vrs;
  139 #ifdef INET
  140         struct ip_moptions       cif_imo;
  141 #endif
  142 #ifdef INET6
  143         struct ip6_moptions      cif_im6o;
  144 #endif
  145         struct ifnet    *cif_ifp;
  146         struct mtx      cif_mtx;
  147         uint32_t        cif_flags;
  148 #define CIF_PROMISC     0x00000001
  149 };
  150 
  151 #define CARP_INET       0
  152 #define CARP_INET6      1
  153 static int proto_reg[] = {-1, -1};
  154 
  155 /*
  156  * Brief design of carp(4).
  157  *
  158  * Any carp-capable ifnet may have a list of carp softcs hanging off
  159  * its ifp->if_carp pointer. Each softc represents one unique virtual
  160  * host id, or vhid. The softc has a back pointer to the ifnet. All
  161  * softcs are joined in a global list, which has quite limited use.
  162  *
  163  * Any interface address that takes part in CARP negotiation has a
  164  * pointer to the softc of its vhid, ifa->ifa_carp. That could be either
  165  * AF_INET or AF_INET6 address.
  166  *
  167  * Although, one can get the softc's backpointer to ifnet and traverse
  168  * through its ifp->if_addrhead queue to find all interface addresses
  169  * involved in CARP, we keep a growable array of ifaddr pointers. This
  170  * allows us to avoid grabbing the IF_ADDR_LOCK() in many traversals that
  171  * do calls into the network stack, thus avoiding LORs.
  172  *
  173  * Locking:
  174  *
  175  * Each softc has a lock sc_mtx. It is used to synchronise carp_input_c(),
  176  * callout-driven events and ioctl()s.
  177  *
  178  * To traverse the list of softcs on an ifnet we use CIF_LOCK() or carp_sx.
  179  * To traverse the global list we use the mutex carp_mtx.
  180  *
  181  * Known issues with locking:
  182  *
  183  * - Sending ad, we put the pointer to the softc in an mtag, and no reference
  184  *   counting is done on the softc.
  185  * - On module unload we may race (?) with packet processing thread
  186  *   dereferencing our function pointers.
  187  */
  188 
  189 /* Accept incoming CARP packets. */
  190 VNET_DEFINE_STATIC(int, carp_allow) = 1;
  191 #define V_carp_allow    VNET(carp_allow)
  192 
  193 /* Set DSCP in outgoing CARP packets. */
  194 VNET_DEFINE_STATIC(int, carp_dscp) = 56;
  195 #define V_carp_dscp     VNET(carp_dscp)
  196 
  197 /* Preempt slower nodes. */
  198 VNET_DEFINE_STATIC(int, carp_preempt) = 0;
  199 #define V_carp_preempt  VNET(carp_preempt)
  200 
  201 /* Log level. */
  202 VNET_DEFINE_STATIC(int, carp_log) = 1;
  203 #define V_carp_log      VNET(carp_log)
  204 
  205 /* Global advskew demotion. */
  206 VNET_DEFINE_STATIC(int, carp_demotion) = 0;
  207 #define V_carp_demotion VNET(carp_demotion)
  208 
  209 /* Send error demotion factor. */
  210 VNET_DEFINE_STATIC(int, carp_senderr_adj) = CARP_MAXSKEW;
  211 #define V_carp_senderr_adj      VNET(carp_senderr_adj)
  212 
  213 /* Iface down demotion factor. */
  214 VNET_DEFINE_STATIC(int, carp_ifdown_adj) = CARP_MAXSKEW;
  215 #define V_carp_ifdown_adj       VNET(carp_ifdown_adj)
  216 
  217 static int carp_allow_sysctl(SYSCTL_HANDLER_ARGS);
  218 static int carp_dscp_sysctl(SYSCTL_HANDLER_ARGS);
  219 static int carp_demote_adj_sysctl(SYSCTL_HANDLER_ARGS);
  220 
  221 SYSCTL_NODE(_net_inet, IPPROTO_CARP,    carp,   CTLFLAG_RW, 0,  "CARP");
  222 SYSCTL_PROC(_net_inet_carp, OID_AUTO, allow,
  223     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, 0, 0, carp_allow_sysctl, "I",
  224     "Accept incoming CARP packets");
  225 SYSCTL_PROC(_net_inet_carp, OID_AUTO, dscp,
  226     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, 0, 0, carp_dscp_sysctl, "I",
  227     "DSCP value for carp packets");
  228 SYSCTL_INT(_net_inet_carp, OID_AUTO, preempt, CTLFLAG_VNET | CTLFLAG_RW,
  229     &VNET_NAME(carp_preempt), 0, "High-priority backup preemption mode");
  230 SYSCTL_INT(_net_inet_carp, OID_AUTO, log, CTLFLAG_VNET | CTLFLAG_RW,
  231     &VNET_NAME(carp_log), 0, "CARP log level");
  232 SYSCTL_PROC(_net_inet_carp, OID_AUTO, demotion,
  233     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW,
  234     0, 0, carp_demote_adj_sysctl, "I",
  235     "Adjust demotion factor (skew of advskew)");
  236 SYSCTL_INT(_net_inet_carp, OID_AUTO, senderr_demotion_factor,
  237     CTLFLAG_VNET | CTLFLAG_RW,
  238     &VNET_NAME(carp_senderr_adj), 0, "Send error demotion factor adjustment");
  239 SYSCTL_INT(_net_inet_carp, OID_AUTO, ifdown_demotion_factor,
  240     CTLFLAG_VNET | CTLFLAG_RW,
  241     &VNET_NAME(carp_ifdown_adj), 0,
  242     "Interface down demotion factor adjustment");
  243 
  244 VNET_PCPUSTAT_DEFINE(struct carpstats, carpstats);
  245 VNET_PCPUSTAT_SYSINIT(carpstats);
  246 VNET_PCPUSTAT_SYSUNINIT(carpstats);
  247 
  248 #define CARPSTATS_ADD(name, val)        \
  249     counter_u64_add(VNET(carpstats)[offsetof(struct carpstats, name) / \
  250         sizeof(uint64_t)], (val))
  251 #define CARPSTATS_INC(name)             CARPSTATS_ADD(name, 1)
  252 
  253 SYSCTL_VNET_PCPUSTAT(_net_inet_carp, OID_AUTO, stats, struct carpstats,
  254     carpstats, "CARP statistics (struct carpstats, netinet/ip_carp.h)");
  255 
  256 #define CARP_LOCK_INIT(sc)      mtx_init(&(sc)->sc_mtx, "carp_softc",   \
  257         NULL, MTX_DEF)
  258 #define CARP_LOCK_DESTROY(sc)   mtx_destroy(&(sc)->sc_mtx)
  259 #define CARP_LOCK_ASSERT(sc)    mtx_assert(&(sc)->sc_mtx, MA_OWNED)
  260 #define CARP_LOCK(sc)           mtx_lock(&(sc)->sc_mtx)
  261 #define CARP_UNLOCK(sc)         mtx_unlock(&(sc)->sc_mtx)
  262 #define CIF_LOCK_INIT(cif)      mtx_init(&(cif)->cif_mtx, "carp_if",   \
  263         NULL, MTX_DEF)
  264 #define CIF_LOCK_DESTROY(cif)   mtx_destroy(&(cif)->cif_mtx)
  265 #define CIF_LOCK_ASSERT(cif)    mtx_assert(&(cif)->cif_mtx, MA_OWNED)
  266 #define CIF_LOCK(cif)           mtx_lock(&(cif)->cif_mtx)
  267 #define CIF_UNLOCK(cif)         mtx_unlock(&(cif)->cif_mtx)
  268 #define CIF_FREE(cif)   do {                            \
  269                 CIF_LOCK(cif);                          \
  270                 if (TAILQ_EMPTY(&(cif)->cif_vrs))       \
  271                         carp_free_if(cif);              \
  272                 else                                    \
  273                         CIF_UNLOCK(cif);                \
  274 } while (0)
  275 
  276 #define CARP_LOG(...)   do {                            \
  277         if (V_carp_log > 0)                             \
  278                 log(LOG_INFO, "carp: " __VA_ARGS__);    \
  279 } while (0)
  280 
  281 #define CARP_DEBUG(...) do {                            \
  282         if (V_carp_log > 1)                             \
  283                 log(LOG_DEBUG, __VA_ARGS__);            \
  284 } while (0)
  285 
  286 #define IFNET_FOREACH_IFA(ifp, ifa)                                     \
  287         CK_STAILQ_FOREACH((ifa), &(ifp)->if_addrhead, ifa_link) \
  288                 if ((ifa)->ifa_carp != NULL)
  289 
  290 #define CARP_FOREACH_IFA(sc, ifa)                                       \
  291         CARP_LOCK_ASSERT(sc);                                           \
  292         for (int _i = 0;                                                \
  293                 _i < (sc)->sc_naddrs + (sc)->sc_naddrs6 &&              \
  294                 ((ifa) = sc->sc_ifas[_i]) != NULL;                      \
  295                 ++_i)
  296 
  297 #define IFNET_FOREACH_CARP(ifp, sc)                                     \
  298         KASSERT(mtx_owned(&ifp->if_carp->cif_mtx) ||                    \
  299             sx_xlocked(&carp_sx), ("cif_vrs not locked"));              \
  300         TAILQ_FOREACH((sc), &(ifp)->if_carp->cif_vrs, sc_list)
  301 
  302 #define DEMOTE_ADVSKEW(sc)                                      \
  303     (((sc)->sc_advskew + V_carp_demotion > CARP_MAXSKEW) ?      \
  304     CARP_MAXSKEW : ((sc)->sc_advskew + V_carp_demotion))
  305 
  306 static void     carp_input_c(struct mbuf *, struct carp_header *, sa_family_t);
  307 static struct carp_softc
  308                 *carp_alloc(struct ifnet *);
  309 static void     carp_destroy(struct carp_softc *);
  310 static struct carp_if
  311                 *carp_alloc_if(struct ifnet *);
  312 static void     carp_free_if(struct carp_if *);
  313 static void     carp_set_state(struct carp_softc *, int, const char* reason);
  314 static void     carp_sc_state(struct carp_softc *);
  315 static void     carp_setrun(struct carp_softc *, sa_family_t);
  316 static void     carp_master_down(void *);
  317 static void     carp_master_down_locked(struct carp_softc *,
  318                     const char* reason);
  319 static void     carp_send_ad(void *);
  320 static void     carp_send_ad_locked(struct carp_softc *);
  321 static void     carp_addroute(struct carp_softc *);
  322 static void     carp_ifa_addroute(struct ifaddr *);
  323 static void     carp_delroute(struct carp_softc *);
  324 static void     carp_ifa_delroute(struct ifaddr *);
  325 static void     carp_send_ad_all(void *, int);
  326 static void     carp_demote_adj(int, char *);
  327 
  328 static LIST_HEAD(, carp_softc) carp_list;
  329 static struct mtx carp_mtx;
  330 static struct sx carp_sx;
  331 static struct task carp_sendall_task =
  332     TASK_INITIALIZER(0, carp_send_ad_all, NULL);
  333 
  334 static void
  335 carp_hmac_prepare(struct carp_softc *sc)
  336 {
  337         uint8_t version = CARP_VERSION, type = CARP_ADVERTISEMENT;
  338         uint8_t vhid = sc->sc_vhid & 0xff;
  339         struct ifaddr *ifa;
  340         int i, found;
  341 #ifdef INET
  342         struct in_addr last, cur, in;
  343 #endif
  344 #ifdef INET6
  345         struct in6_addr last6, cur6, in6;
  346 #endif
  347 
  348         CARP_LOCK_ASSERT(sc);
  349 
  350         /* Compute ipad from key. */
  351         bzero(sc->sc_pad, sizeof(sc->sc_pad));
  352         bcopy(sc->sc_key, sc->sc_pad, sizeof(sc->sc_key));
  353         for (i = 0; i < sizeof(sc->sc_pad); i++)
  354                 sc->sc_pad[i] ^= 0x36;
  355 
  356         /* Precompute first part of inner hash. */
  357         SHA1Init(&sc->sc_sha1);
  358         SHA1Update(&sc->sc_sha1, sc->sc_pad, sizeof(sc->sc_pad));
  359         SHA1Update(&sc->sc_sha1, (void *)&version, sizeof(version));
  360         SHA1Update(&sc->sc_sha1, (void *)&type, sizeof(type));
  361         SHA1Update(&sc->sc_sha1, (void *)&vhid, sizeof(vhid));
  362 #ifdef INET
  363         cur.s_addr = 0;
  364         do {
  365                 found = 0;
  366                 last = cur;
  367                 cur.s_addr = 0xffffffff;
  368                 CARP_FOREACH_IFA(sc, ifa) {
  369                         in.s_addr = ifatoia(ifa)->ia_addr.sin_addr.s_addr;
  370                         if (ifa->ifa_addr->sa_family == AF_INET &&
  371                             ntohl(in.s_addr) > ntohl(last.s_addr) &&
  372                             ntohl(in.s_addr) < ntohl(cur.s_addr)) {
  373                                 cur.s_addr = in.s_addr;
  374                                 found++;
  375                         }
  376                 }
  377                 if (found)
  378                         SHA1Update(&sc->sc_sha1, (void *)&cur, sizeof(cur));
  379         } while (found);
  380 #endif /* INET */
  381 #ifdef INET6
  382         memset(&cur6, 0, sizeof(cur6));
  383         do {
  384                 found = 0;
  385                 last6 = cur6;
  386                 memset(&cur6, 0xff, sizeof(cur6));
  387                 CARP_FOREACH_IFA(sc, ifa) {
  388                         in6 = ifatoia6(ifa)->ia_addr.sin6_addr;
  389                         if (IN6_IS_SCOPE_EMBED(&in6))
  390                                 in6.s6_addr16[1] = 0;
  391                         if (ifa->ifa_addr->sa_family == AF_INET6 &&
  392                             memcmp(&in6, &last6, sizeof(in6)) > 0 &&
  393                             memcmp(&in6, &cur6, sizeof(in6)) < 0) {
  394                                 cur6 = in6;
  395                                 found++;
  396                         }
  397                 }
  398                 if (found)
  399                         SHA1Update(&sc->sc_sha1, (void *)&cur6, sizeof(cur6));
  400         } while (found);
  401 #endif /* INET6 */
  402 
  403         /* convert ipad to opad */
  404         for (i = 0; i < sizeof(sc->sc_pad); i++)
  405                 sc->sc_pad[i] ^= 0x36 ^ 0x5c;
  406 }
  407 
  408 static void
  409 carp_hmac_generate(struct carp_softc *sc, uint32_t counter[2],
  410     unsigned char md[20])
  411 {
  412         SHA1_CTX sha1ctx;
  413 
  414         CARP_LOCK_ASSERT(sc);
  415 
  416         /* fetch first half of inner hash */
  417         bcopy(&sc->sc_sha1, &sha1ctx, sizeof(sha1ctx));
  418 
  419         SHA1Update(&sha1ctx, (void *)counter, sizeof(sc->sc_counter));
  420         SHA1Final(md, &sha1ctx);
  421 
  422         /* outer hash */
  423         SHA1Init(&sha1ctx);
  424         SHA1Update(&sha1ctx, sc->sc_pad, sizeof(sc->sc_pad));
  425         SHA1Update(&sha1ctx, md, 20);
  426         SHA1Final(md, &sha1ctx);
  427 }
  428 
  429 static int
  430 carp_hmac_verify(struct carp_softc *sc, uint32_t counter[2],
  431     unsigned char md[20])
  432 {
  433         unsigned char md2[20];
  434 
  435         CARP_LOCK_ASSERT(sc);
  436 
  437         carp_hmac_generate(sc, counter, md2);
  438 
  439         return (bcmp(md, md2, sizeof(md2)));
  440 }
  441 
  442 /*
  443  * process input packet.
  444  * we have rearranged checks order compared to the rfc,
  445  * but it seems more efficient this way or not possible otherwise.
  446  */
  447 #ifdef INET
  448 int
  449 carp_input(struct mbuf **mp, int *offp, int proto)
  450 {
  451         struct mbuf *m = *mp;
  452         struct ip *ip = mtod(m, struct ip *);
  453         struct carp_header *ch;
  454         int iplen, len;
  455 
  456         iplen = *offp;
  457         *mp = NULL;
  458 
  459         CARPSTATS_INC(carps_ipackets);
  460 
  461         if (!V_carp_allow) {
  462                 m_freem(m);
  463                 return (IPPROTO_DONE);
  464         }
  465 
  466         /* verify that the IP TTL is 255.  */
  467         if (ip->ip_ttl != CARP_DFLTTL) {
  468                 CARPSTATS_INC(carps_badttl);
  469                 CARP_DEBUG("%s: received ttl %d != 255 on %s\n", __func__,
  470                     ip->ip_ttl,
  471                     m->m_pkthdr.rcvif->if_xname);
  472                 m_freem(m);
  473                 return (IPPROTO_DONE);
  474         }
  475 
  476         iplen = ip->ip_hl << 2;
  477 
  478         if (m->m_pkthdr.len < iplen + sizeof(*ch)) {
  479                 CARPSTATS_INC(carps_badlen);
  480                 CARP_DEBUG("%s: received len %zd < sizeof(struct carp_header) "
  481                     "on %s\n", __func__, m->m_len - sizeof(struct ip),
  482                     m->m_pkthdr.rcvif->if_xname);
  483                 m_freem(m);
  484                 return (IPPROTO_DONE);
  485         }
  486 
  487         if (iplen + sizeof(*ch) < m->m_len) {
  488                 if ((m = m_pullup(m, iplen + sizeof(*ch))) == NULL) {
  489                         CARPSTATS_INC(carps_hdrops);
  490                         CARP_DEBUG("%s: pullup failed\n", __func__);
  491                         return (IPPROTO_DONE);
  492                 }
  493                 ip = mtod(m, struct ip *);
  494         }
  495         ch = (struct carp_header *)((char *)ip + iplen);
  496 
  497         /*
  498          * verify that the received packet length is
  499          * equal to the CARP header
  500          */
  501         len = iplen + sizeof(*ch);
  502         if (len > m->m_pkthdr.len) {
  503                 CARPSTATS_INC(carps_badlen);
  504                 CARP_DEBUG("%s: packet too short %d on %s\n", __func__,
  505                     m->m_pkthdr.len,
  506                     m->m_pkthdr.rcvif->if_xname);
  507                 m_freem(m);
  508                 return (IPPROTO_DONE);
  509         }
  510 
  511         if ((m = m_pullup(m, len)) == NULL) {
  512                 CARPSTATS_INC(carps_hdrops);
  513                 return (IPPROTO_DONE);
  514         }
  515         ip = mtod(m, struct ip *);
  516         ch = (struct carp_header *)((char *)ip + iplen);
  517 
  518         /* verify the CARP checksum */
  519         m->m_data += iplen;
  520         if (in_cksum(m, len - iplen)) {
  521                 CARPSTATS_INC(carps_badsum);
  522                 CARP_DEBUG("%s: checksum failed on %s\n", __func__,
  523                     m->m_pkthdr.rcvif->if_xname);
  524                 m_freem(m);
  525                 return (IPPROTO_DONE);
  526         }
  527         m->m_data -= iplen;
  528 
  529         carp_input_c(m, ch, AF_INET);
  530         return (IPPROTO_DONE);
  531 }
  532 #endif
  533 
  534 #ifdef INET6
  535 int
  536 carp6_input(struct mbuf **mp, int *offp, int proto)
  537 {
  538         struct mbuf *m = *mp;
  539         struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
  540         struct carp_header *ch;
  541         u_int len;
  542 
  543         CARPSTATS_INC(carps_ipackets6);
  544 
  545         if (!V_carp_allow) {
  546                 m_freem(m);
  547                 return (IPPROTO_DONE);
  548         }
  549 
  550         /* check if received on a valid carp interface */
  551         if (m->m_pkthdr.rcvif->if_carp == NULL) {
  552                 CARPSTATS_INC(carps_badif);
  553                 CARP_DEBUG("%s: packet received on non-carp interface: %s\n",
  554                     __func__, m->m_pkthdr.rcvif->if_xname);
  555                 m_freem(m);
  556                 return (IPPROTO_DONE);
  557         }
  558 
  559         /* verify that the IP TTL is 255 */
  560         if (ip6->ip6_hlim != CARP_DFLTTL) {
  561                 CARPSTATS_INC(carps_badttl);
  562                 CARP_DEBUG("%s: received ttl %d != 255 on %s\n", __func__,
  563                     ip6->ip6_hlim, m->m_pkthdr.rcvif->if_xname);
  564                 m_freem(m);
  565                 return (IPPROTO_DONE);
  566         }
  567 
  568         /* verify that we have a complete carp packet */
  569         len = m->m_len;
  570         IP6_EXTHDR_GET(ch, struct carp_header *, m, *offp, sizeof(*ch));
  571         if (ch == NULL) {
  572                 CARPSTATS_INC(carps_badlen);
  573                 CARP_DEBUG("%s: packet size %u too small\n", __func__, len);
  574                 return (IPPROTO_DONE);
  575         }
  576 
  577 
  578         /* verify the CARP checksum */
  579         m->m_data += *offp;
  580         if (in_cksum(m, sizeof(*ch))) {
  581                 CARPSTATS_INC(carps_badsum);
  582                 CARP_DEBUG("%s: checksum failed, on %s\n", __func__,
  583                     m->m_pkthdr.rcvif->if_xname);
  584                 m_freem(m);
  585                 return (IPPROTO_DONE);
  586         }
  587         m->m_data -= *offp;
  588 
  589         carp_input_c(m, ch, AF_INET6);
  590         return (IPPROTO_DONE);
  591 }
  592 #endif /* INET6 */
  593 
  594 /*
  595  * This routine should not be necessary at all, but some switches
  596  * (VMWare ESX vswitches) can echo our own packets back at us,
  597  * and we must ignore them or they will cause us to drop out of
  598  * MASTER mode.
  599  *
  600  * We cannot catch all cases of network loops.  Instead, what we
  601  * do here is catch any packet that arrives with a carp header
  602  * with a VHID of 0, that comes from an address that is our own.
  603  * These packets are by definition "from us" (even if they are from
  604  * a misconfigured host that is pretending to be us).
  605  *
  606  * The VHID test is outside this mini-function.
  607  */
  608 static int
  609 carp_source_is_self(struct mbuf *m, struct ifaddr *ifa, sa_family_t af)
  610 {
  611 #ifdef INET
  612         struct ip *ip4;
  613         struct in_addr in4;
  614 #endif
  615 #ifdef INET6
  616         struct ip6_hdr *ip6;
  617         struct in6_addr in6;
  618 #endif
  619 
  620         switch (af) {
  621 #ifdef INET
  622         case AF_INET:
  623                 ip4 = mtod(m, struct ip *);
  624                 in4 = ifatoia(ifa)->ia_addr.sin_addr;
  625                 return (in4.s_addr == ip4->ip_src.s_addr);
  626 #endif
  627 #ifdef INET6
  628         case AF_INET6:
  629                 ip6 = mtod(m, struct ip6_hdr *);
  630                 in6 = ifatoia6(ifa)->ia_addr.sin6_addr;
  631                 return (memcmp(&in6, &ip6->ip6_src, sizeof(in6)) == 0);
  632 #endif
  633         default:
  634                 break;
  635         }
  636         return (0);
  637 }
  638 
  639 static void
  640 carp_input_c(struct mbuf *m, struct carp_header *ch, sa_family_t af)
  641 {
  642         struct ifnet *ifp = m->m_pkthdr.rcvif;
  643         struct ifaddr *ifa, *match;
  644         struct carp_softc *sc;
  645         uint64_t tmp_counter;
  646         struct timeval sc_tv, ch_tv;
  647         int error;
  648 
  649         /*
  650          * Verify that the VHID is valid on the receiving interface.
  651          *
  652          * There should be just one match.  If there are none
  653          * the VHID is not valid and we drop the packet.  If
  654          * there are multiple VHID matches, take just the first
  655          * one, for compatibility with previous code.  While we're
  656          * scanning, check for obvious loops in the network topology
  657          * (these should never happen, and as noted above, we may
  658          * miss real loops; this is just a double-check).
  659          */
  660         IF_ADDR_RLOCK(ifp);
  661         error = 0;
  662         match = NULL;
  663         IFNET_FOREACH_IFA(ifp, ifa) {
  664                 if (match == NULL && ifa->ifa_carp != NULL &&
  665                     ifa->ifa_addr->sa_family == af &&
  666                     ifa->ifa_carp->sc_vhid == ch->carp_vhid)
  667                         match = ifa;
  668                 if (ch->carp_vhid == 0 && carp_source_is_self(m, ifa, af))
  669                         error = ELOOP;
  670         }
  671         ifa = error ? NULL : match;
  672         if (ifa != NULL)
  673                 ifa_ref(ifa);
  674         IF_ADDR_RUNLOCK(ifp);
  675 
  676         if (ifa == NULL) {
  677                 if (error == ELOOP) {
  678                         CARP_DEBUG("dropping looped packet on interface %s\n",
  679                             ifp->if_xname);
  680                         CARPSTATS_INC(carps_badif);     /* ??? */
  681                 } else {
  682                         CARPSTATS_INC(carps_badvhid);
  683                 }
  684                 m_freem(m);
  685                 return;
  686         }
  687 
  688         /* verify the CARP version. */
  689         if (ch->carp_version != CARP_VERSION) {
  690                 CARPSTATS_INC(carps_badver);
  691                 CARP_DEBUG("%s: invalid version %d\n", ifp->if_xname,
  692                     ch->carp_version);
  693                 ifa_free(ifa);
  694                 m_freem(m);
  695                 return;
  696         }
  697 
  698         sc = ifa->ifa_carp;
  699         CARP_LOCK(sc);
  700         ifa_free(ifa);
  701 
  702         if (carp_hmac_verify(sc, ch->carp_counter, ch->carp_md)) {
  703                 CARPSTATS_INC(carps_badauth);
  704                 CARP_DEBUG("%s: incorrect hash for VHID %u@%s\n", __func__,
  705                     sc->sc_vhid, ifp->if_xname);
  706                 goto out;
  707         }
  708 
  709         tmp_counter = ntohl(ch->carp_counter[0]);
  710         tmp_counter = tmp_counter<<32;
  711         tmp_counter += ntohl(ch->carp_counter[1]);
  712 
  713         /* XXX Replay protection goes here */
  714 
  715         sc->sc_init_counter = 0;
  716         sc->sc_counter = tmp_counter;
  717 
  718         sc_tv.tv_sec = sc->sc_advbase;
  719         sc_tv.tv_usec = DEMOTE_ADVSKEW(sc) * 1000000 / 256;
  720         ch_tv.tv_sec = ch->carp_advbase;
  721         ch_tv.tv_usec = ch->carp_advskew * 1000000 / 256;
  722 
  723         switch (sc->sc_state) {
  724         case INIT:
  725                 break;
  726         case MASTER:
  727                 /*
  728                  * If we receive an advertisement from a master who's going to
  729                  * be more frequent than us, go into BACKUP state.
  730                  */
  731                 if (timevalcmp(&sc_tv, &ch_tv, >) ||
  732                     timevalcmp(&sc_tv, &ch_tv, ==)) {
  733                         callout_stop(&sc->sc_ad_tmo);
  734                         carp_set_state(sc, BACKUP,
  735                             "more frequent advertisement received");
  736                         carp_setrun(sc, 0);
  737                         carp_delroute(sc);
  738                 }
  739                 break;
  740         case BACKUP:
  741                 /*
  742                  * If we're pre-empting masters who advertise slower than us,
  743                  * and this one claims to be slower, treat him as down.
  744                  */
  745                 if (V_carp_preempt && timevalcmp(&sc_tv, &ch_tv, <)) {
  746                         carp_master_down_locked(sc,
  747                             "preempting a slower master");
  748                         break;
  749                 }
  750 
  751                 /*
  752                  *  If the master is going to advertise at such a low frequency
  753                  *  that he's guaranteed to time out, we'd might as well just
  754                  *  treat him as timed out now.
  755                  */
  756                 sc_tv.tv_sec = sc->sc_advbase * 3;
  757                 if (timevalcmp(&sc_tv, &ch_tv, <)) {
  758                         carp_master_down_locked(sc, "master will time out");
  759                         break;
  760                 }
  761 
  762                 /*
  763                  * Otherwise, we reset the counter and wait for the next
  764                  * advertisement.
  765                  */
  766                 carp_setrun(sc, af);
  767                 break;
  768         }
  769 
  770 out:
  771         CARP_UNLOCK(sc);
  772         m_freem(m);
  773 }
  774 
  775 static int
  776 carp_prepare_ad(struct mbuf *m, struct carp_softc *sc, struct carp_header *ch)
  777 {
  778         struct m_tag *mtag;
  779 
  780         if (sc->sc_init_counter) {
  781                 /* this could also be seconds since unix epoch */
  782                 sc->sc_counter = arc4random();
  783                 sc->sc_counter = sc->sc_counter << 32;
  784                 sc->sc_counter += arc4random();
  785         } else
  786                 sc->sc_counter++;
  787 
  788         ch->carp_counter[0] = htonl((sc->sc_counter>>32)&0xffffffff);
  789         ch->carp_counter[1] = htonl(sc->sc_counter&0xffffffff);
  790 
  791         carp_hmac_generate(sc, ch->carp_counter, ch->carp_md);
  792 
  793         /* Tag packet for carp_output */
  794         if ((mtag = m_tag_get(PACKET_TAG_CARP, sizeof(struct carp_softc *),
  795             M_NOWAIT)) == NULL) {
  796                 m_freem(m);
  797                 CARPSTATS_INC(carps_onomem);
  798                 return (ENOMEM);
  799         }
  800         bcopy(&sc, mtag + 1, sizeof(sc));
  801         m_tag_prepend(m, mtag);
  802 
  803         return (0);
  804 }
  805 
  806 /*
  807  * To avoid LORs and possible recursions this function shouldn't
  808  * be called directly, but scheduled via taskqueue.
  809  */
  810 static void
  811 carp_send_ad_all(void *ctx __unused, int pending __unused)
  812 {
  813         struct carp_softc *sc;
  814 
  815         mtx_lock(&carp_mtx);
  816         LIST_FOREACH(sc, &carp_list, sc_next)
  817                 if (sc->sc_state == MASTER) {
  818                         CARP_LOCK(sc);
  819                         CURVNET_SET(sc->sc_carpdev->if_vnet);
  820                         carp_send_ad_locked(sc);
  821                         CURVNET_RESTORE();
  822                         CARP_UNLOCK(sc);
  823                 }
  824         mtx_unlock(&carp_mtx);
  825 }
  826 
  827 /* Send a periodic advertisement, executed in callout context. */
  828 static void
  829 carp_send_ad(void *v)
  830 {
  831         struct carp_softc *sc = v;
  832 
  833         CARP_LOCK_ASSERT(sc);
  834         CURVNET_SET(sc->sc_carpdev->if_vnet);
  835         carp_send_ad_locked(sc);
  836         CURVNET_RESTORE();
  837         CARP_UNLOCK(sc);
  838 }
  839 
  840 static void
  841 carp_send_ad_error(struct carp_softc *sc, int error)
  842 {
  843 
  844         if (error) {
  845                 if (sc->sc_sendad_errors < INT_MAX)
  846                         sc->sc_sendad_errors++;
  847                 if (sc->sc_sendad_errors == CARP_SENDAD_MAX_ERRORS) {
  848                         static const char fmt[] = "send error %d on %s";
  849                         char msg[sizeof(fmt) + IFNAMSIZ];
  850 
  851                         sprintf(msg, fmt, error, sc->sc_carpdev->if_xname);
  852                         carp_demote_adj(V_carp_senderr_adj, msg);
  853                 }
  854                 sc->sc_sendad_success = 0;
  855         } else {
  856                 if (sc->sc_sendad_errors >= CARP_SENDAD_MAX_ERRORS &&
  857                     ++sc->sc_sendad_success >= CARP_SENDAD_MIN_SUCCESS) {
  858                         static const char fmt[] = "send ok on %s";
  859                         char msg[sizeof(fmt) + IFNAMSIZ];
  860 
  861                         sprintf(msg, fmt, sc->sc_carpdev->if_xname);
  862                         carp_demote_adj(-V_carp_senderr_adj, msg);
  863                         sc->sc_sendad_errors = 0;
  864                 } else
  865                         sc->sc_sendad_errors = 0;
  866         }
  867 }
  868 
  869 /*
  870  * Pick the best ifaddr on the given ifp for sending CARP
  871  * advertisements.
  872  *
  873  * "Best" here is defined by ifa_preferred().  This function is much
  874  * much like ifaof_ifpforaddr() except that we just use ifa_preferred().
  875  *
  876  * (This could be simplified to return the actual address, except that
  877  * it has a different format in AF_INET and AF_INET6.)
  878  */
  879 static struct ifaddr *
  880 carp_best_ifa(int af, struct ifnet *ifp)
  881 {
  882         struct ifaddr *ifa, *best;
  883 
  884         if (af >= AF_MAX)
  885                 return (NULL);
  886         best = NULL;
  887         IF_ADDR_RLOCK(ifp);
  888         CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
  889                 if (ifa->ifa_addr->sa_family == af &&
  890                     (best == NULL || ifa_preferred(best, ifa)))
  891                         best = ifa;
  892         }
  893         IF_ADDR_RUNLOCK(ifp);
  894         if (best != NULL)
  895                 ifa_ref(best);
  896         return (best);
  897 }
  898 
  899 static void
  900 carp_send_ad_locked(struct carp_softc *sc)
  901 {
  902         struct carp_header ch;
  903         struct timeval tv;
  904         struct ifaddr *ifa;
  905         struct carp_header *ch_ptr;
  906         struct mbuf *m;
  907         int len, advskew;
  908 
  909         CARP_LOCK_ASSERT(sc);
  910 
  911         advskew = DEMOTE_ADVSKEW(sc);
  912         tv.tv_sec = sc->sc_advbase;
  913         tv.tv_usec = advskew * 1000000 / 256;
  914 
  915         ch.carp_version = CARP_VERSION;
  916         ch.carp_type = CARP_ADVERTISEMENT;
  917         ch.carp_vhid = sc->sc_vhid;
  918         ch.carp_advbase = sc->sc_advbase;
  919         ch.carp_advskew = advskew;
  920         ch.carp_authlen = 7;    /* XXX DEFINE */
  921         ch.carp_pad1 = 0;       /* must be zero */
  922         ch.carp_cksum = 0;
  923 
  924         /* XXXGL: OpenBSD picks first ifaddr with needed family. */
  925 
  926 #ifdef INET
  927         if (sc->sc_naddrs) {
  928                 struct ip *ip;
  929 
  930                 m = m_gethdr(M_NOWAIT, MT_DATA);
  931                 if (m == NULL) {
  932                         CARPSTATS_INC(carps_onomem);
  933                         goto resched;
  934                 }
  935                 len = sizeof(*ip) + sizeof(ch);
  936                 m->m_pkthdr.len = len;
  937                 m->m_pkthdr.rcvif = NULL;
  938                 m->m_len = len;
  939                 M_ALIGN(m, m->m_len);
  940                 m->m_flags |= M_MCAST;
  941                 ip = mtod(m, struct ip *);
  942                 ip->ip_v = IPVERSION;
  943                 ip->ip_hl = sizeof(*ip) >> 2;
  944                 ip->ip_tos = V_carp_dscp << IPTOS_DSCP_OFFSET;
  945                 ip->ip_len = htons(len);
  946                 ip->ip_off = htons(IP_DF);
  947                 ip->ip_ttl = CARP_DFLTTL;
  948                 ip->ip_p = IPPROTO_CARP;
  949                 ip->ip_sum = 0;
  950                 ip_fillid(ip);
  951 
  952                 ifa = carp_best_ifa(AF_INET, sc->sc_carpdev);
  953                 if (ifa != NULL) {
  954                         ip->ip_src.s_addr =
  955                             ifatoia(ifa)->ia_addr.sin_addr.s_addr;
  956                         ifa_free(ifa);
  957                 } else
  958                         ip->ip_src.s_addr = 0;
  959                 ip->ip_dst.s_addr = htonl(INADDR_CARP_GROUP);
  960 
  961                 ch_ptr = (struct carp_header *)(&ip[1]);
  962                 bcopy(&ch, ch_ptr, sizeof(ch));
  963                 if (carp_prepare_ad(m, sc, ch_ptr))
  964                         goto resched;
  965 
  966                 m->m_data += sizeof(*ip);
  967                 ch_ptr->carp_cksum = in_cksum(m, len - sizeof(*ip));
  968                 m->m_data -= sizeof(*ip);
  969 
  970                 CARPSTATS_INC(carps_opackets);
  971 
  972                 carp_send_ad_error(sc, ip_output(m, NULL, NULL, IP_RAWOUTPUT,
  973                     &sc->sc_carpdev->if_carp->cif_imo, NULL));
  974         }
  975 #endif /* INET */
  976 #ifdef INET6
  977         if (sc->sc_naddrs6) {
  978                 struct ip6_hdr *ip6;
  979 
  980                 m = m_gethdr(M_NOWAIT, MT_DATA);
  981                 if (m == NULL) {
  982                         CARPSTATS_INC(carps_onomem);
  983                         goto resched;
  984                 }
  985                 len = sizeof(*ip6) + sizeof(ch);
  986                 m->m_pkthdr.len = len;
  987                 m->m_pkthdr.rcvif = NULL;
  988                 m->m_len = len;
  989                 M_ALIGN(m, m->m_len);
  990                 m->m_flags |= M_MCAST;
  991                 ip6 = mtod(m, struct ip6_hdr *);
  992                 bzero(ip6, sizeof(*ip6));
  993                 ip6->ip6_vfc |= IPV6_VERSION;
  994                 /* Traffic class isn't defined in ip6 struct instead
  995                  * it gets offset into flowid field */
  996                 ip6->ip6_flow |= htonl(V_carp_dscp << (IPV6_FLOWLABEL_LEN +
  997                     IPTOS_DSCP_OFFSET));
  998                 ip6->ip6_hlim = CARP_DFLTTL;
  999                 ip6->ip6_nxt = IPPROTO_CARP;
 1000 
 1001                 /* set the source address */
 1002                 ifa = carp_best_ifa(AF_INET6, sc->sc_carpdev);
 1003                 if (ifa != NULL) {
 1004                         bcopy(IFA_IN6(ifa), &ip6->ip6_src,
 1005                             sizeof(struct in6_addr));
 1006                         ifa_free(ifa);
 1007                 } else
 1008                         /* This should never happen with IPv6. */
 1009                         bzero(&ip6->ip6_src, sizeof(struct in6_addr));
 1010 
 1011                 /* Set the multicast destination. */
 1012                 ip6->ip6_dst.s6_addr16[0] = htons(0xff02);
 1013                 ip6->ip6_dst.s6_addr8[15] = 0x12;
 1014                 if (in6_setscope(&ip6->ip6_dst, sc->sc_carpdev, NULL) != 0) {
 1015                         m_freem(m);
 1016                         CARP_DEBUG("%s: in6_setscope failed\n", __func__);
 1017                         goto resched;
 1018                 }
 1019 
 1020                 ch_ptr = (struct carp_header *)(&ip6[1]);
 1021                 bcopy(&ch, ch_ptr, sizeof(ch));
 1022                 if (carp_prepare_ad(m, sc, ch_ptr))
 1023                         goto resched;
 1024 
 1025                 m->m_data += sizeof(*ip6);
 1026                 ch_ptr->carp_cksum = in_cksum(m, len - sizeof(*ip6));
 1027                 m->m_data -= sizeof(*ip6);
 1028 
 1029                 CARPSTATS_INC(carps_opackets6);
 1030 
 1031                 carp_send_ad_error(sc, ip6_output(m, NULL, NULL, 0,
 1032                     &sc->sc_carpdev->if_carp->cif_im6o, NULL, NULL));
 1033         }
 1034 #endif /* INET6 */
 1035 
 1036 resched:
 1037         callout_reset(&sc->sc_ad_tmo, tvtohz(&tv), carp_send_ad, sc);
 1038 }
 1039 
 1040 static void
 1041 carp_addroute(struct carp_softc *sc)
 1042 {
 1043         struct ifaddr *ifa;
 1044 
 1045         CARP_FOREACH_IFA(sc, ifa)
 1046                 carp_ifa_addroute(ifa);
 1047 }
 1048 
 1049 static void
 1050 carp_ifa_addroute(struct ifaddr *ifa)
 1051 {
 1052 
 1053         switch (ifa->ifa_addr->sa_family) {
 1054 #ifdef INET
 1055         case AF_INET:
 1056                 in_addprefix(ifatoia(ifa), RTF_UP);
 1057                 ifa_add_loopback_route(ifa,
 1058                     (struct sockaddr *)&ifatoia(ifa)->ia_addr);
 1059                 break;
 1060 #endif
 1061 #ifdef INET6
 1062         case AF_INET6:
 1063                 ifa_add_loopback_route(ifa,
 1064                     (struct sockaddr *)&ifatoia6(ifa)->ia_addr);
 1065                 nd6_add_ifa_lle(ifatoia6(ifa));
 1066                 break;
 1067 #endif
 1068         }
 1069 }
 1070 
 1071 static void
 1072 carp_delroute(struct carp_softc *sc)
 1073 {
 1074         struct ifaddr *ifa;
 1075 
 1076         CARP_FOREACH_IFA(sc, ifa)
 1077                 carp_ifa_delroute(ifa);
 1078 }
 1079 
 1080 static void
 1081 carp_ifa_delroute(struct ifaddr *ifa)
 1082 {
 1083 
 1084         switch (ifa->ifa_addr->sa_family) {
 1085 #ifdef INET
 1086         case AF_INET:
 1087                 ifa_del_loopback_route(ifa,
 1088                     (struct sockaddr *)&ifatoia(ifa)->ia_addr);
 1089                 in_scrubprefix(ifatoia(ifa), LLE_STATIC);
 1090                 break;
 1091 #endif
 1092 #ifdef INET6
 1093         case AF_INET6:
 1094                 ifa_del_loopback_route(ifa,
 1095                     (struct sockaddr *)&ifatoia6(ifa)->ia_addr);
 1096                 nd6_rem_ifa_lle(ifatoia6(ifa), 1);
 1097                 break;
 1098 #endif
 1099         }
 1100 }
 1101 
 1102 int
 1103 carp_master(struct ifaddr *ifa)
 1104 {
 1105         struct carp_softc *sc = ifa->ifa_carp;
 1106 
 1107         return (sc->sc_state == MASTER);
 1108 }
 1109 
 1110 #ifdef INET
 1111 /*
 1112  * Broadcast a gratuitous ARP request containing
 1113  * the virtual router MAC address for each IP address
 1114  * associated with the virtual router.
 1115  */
 1116 static void
 1117 carp_send_arp(struct carp_softc *sc)
 1118 {
 1119         struct ifaddr *ifa;
 1120         struct in_addr addr;
 1121 
 1122         CARP_FOREACH_IFA(sc, ifa) {
 1123                 if (ifa->ifa_addr->sa_family != AF_INET)
 1124                         continue;
 1125                 addr = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
 1126                 arp_announce_ifaddr(sc->sc_carpdev, addr, LLADDR(&sc->sc_addr));
 1127         }
 1128 }
 1129 
 1130 int
 1131 carp_iamatch(struct ifaddr *ifa, uint8_t **enaddr)
 1132 {
 1133         struct carp_softc *sc = ifa->ifa_carp;
 1134 
 1135         if (sc->sc_state == MASTER) {
 1136                 *enaddr = LLADDR(&sc->sc_addr);
 1137                 return (1);
 1138         }
 1139 
 1140         return (0);
 1141 }
 1142 #endif
 1143 
 1144 #ifdef INET6
 1145 static void
 1146 carp_send_na(struct carp_softc *sc)
 1147 {
 1148         static struct in6_addr mcast = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
 1149         struct ifaddr *ifa;
 1150         struct in6_addr *in6;
 1151 
 1152         CARP_FOREACH_IFA(sc, ifa) {
 1153                 if (ifa->ifa_addr->sa_family != AF_INET6)
 1154                         continue;
 1155 
 1156                 in6 = IFA_IN6(ifa);
 1157                 nd6_na_output(sc->sc_carpdev, &mcast, in6,
 1158                     ND_NA_FLAG_OVERRIDE, 1, NULL);
 1159                 DELAY(1000);    /* XXX */
 1160         }
 1161 }
 1162 
 1163 /*
 1164  * Returns ifa in case it's a carp address and it is MASTER, or if the address
 1165  * matches and is not a carp address.  Returns NULL otherwise.
 1166  */
 1167 struct ifaddr *
 1168 carp_iamatch6(struct ifnet *ifp, struct in6_addr *taddr)
 1169 {
 1170         struct ifaddr *ifa;
 1171 
 1172         ifa = NULL;
 1173         IF_ADDR_RLOCK(ifp);
 1174         CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
 1175                 if (ifa->ifa_addr->sa_family != AF_INET6)
 1176                         continue;
 1177                 if (!IN6_ARE_ADDR_EQUAL(taddr, IFA_IN6(ifa)))
 1178                         continue;
 1179                 if (ifa->ifa_carp && ifa->ifa_carp->sc_state != MASTER)
 1180                         ifa = NULL;
 1181                 else
 1182                         ifa_ref(ifa);
 1183                 break;
 1184         }
 1185         IF_ADDR_RUNLOCK(ifp);
 1186 
 1187         return (ifa);
 1188 }
 1189 
 1190 caddr_t
 1191 carp_macmatch6(struct ifnet *ifp, struct mbuf *m, const struct in6_addr *taddr)
 1192 {
 1193         struct ifaddr *ifa;
 1194 
 1195         IF_ADDR_RLOCK(ifp);
 1196         IFNET_FOREACH_IFA(ifp, ifa)
 1197                 if (ifa->ifa_addr->sa_family == AF_INET6 &&
 1198                     IN6_ARE_ADDR_EQUAL(taddr, IFA_IN6(ifa))) {
 1199                         struct carp_softc *sc = ifa->ifa_carp;
 1200                         struct m_tag *mtag;
 1201 
 1202                         IF_ADDR_RUNLOCK(ifp);
 1203 
 1204                         mtag = m_tag_get(PACKET_TAG_CARP,
 1205                             sizeof(struct carp_softc *), M_NOWAIT);
 1206                         if (mtag == NULL)
 1207                                 /* Better a bit than nothing. */
 1208                                 return (LLADDR(&sc->sc_addr));
 1209 
 1210                         bcopy(&sc, mtag + 1, sizeof(sc));
 1211                         m_tag_prepend(m, mtag);
 1212 
 1213                         return (LLADDR(&sc->sc_addr));
 1214                 }
 1215         IF_ADDR_RUNLOCK(ifp);
 1216 
 1217         return (NULL);
 1218 }
 1219 #endif /* INET6 */
 1220 
 1221 int
 1222 carp_forus(struct ifnet *ifp, u_char *dhost)
 1223 {
 1224         struct carp_softc *sc;
 1225         uint8_t *ena = dhost;
 1226 
 1227         if (ena[0] || ena[1] || ena[2] != 0x5e || ena[3] || ena[4] != 1)
 1228                 return (0);
 1229 
 1230         CIF_LOCK(ifp->if_carp);
 1231         IFNET_FOREACH_CARP(ifp, sc) {
 1232                 CARP_LOCK(sc);
 1233                 if (sc->sc_state == MASTER && !bcmp(dhost, LLADDR(&sc->sc_addr),
 1234                     ETHER_ADDR_LEN)) {
 1235                         CARP_UNLOCK(sc);
 1236                         CIF_UNLOCK(ifp->if_carp);
 1237                         return (1);
 1238                 }
 1239                 CARP_UNLOCK(sc);
 1240         }
 1241         CIF_UNLOCK(ifp->if_carp);
 1242 
 1243         return (0);
 1244 }
 1245 
 1246 /* Master down timeout event, executed in callout context. */
 1247 static void
 1248 carp_master_down(void *v)
 1249 {
 1250         struct carp_softc *sc = v;
 1251 
 1252         CARP_LOCK_ASSERT(sc);
 1253 
 1254         CURVNET_SET(sc->sc_carpdev->if_vnet);
 1255         if (sc->sc_state == BACKUP) {
 1256                 carp_master_down_locked(sc, "master timed out");
 1257         }
 1258         CURVNET_RESTORE();
 1259 
 1260         CARP_UNLOCK(sc);
 1261 }
 1262 
 1263 static void
 1264 carp_master_down_locked(struct carp_softc *sc, const char *reason)
 1265 {
 1266 
 1267         CARP_LOCK_ASSERT(sc);
 1268 
 1269         switch (sc->sc_state) {
 1270         case BACKUP:
 1271                 carp_set_state(sc, MASTER, reason);
 1272                 carp_send_ad_locked(sc);
 1273 #ifdef INET
 1274                 carp_send_arp(sc);
 1275 #endif
 1276 #ifdef INET6
 1277                 carp_send_na(sc);
 1278 #endif
 1279                 carp_setrun(sc, 0);
 1280                 carp_addroute(sc);
 1281                 break;
 1282         case INIT:
 1283         case MASTER:
 1284 #ifdef INVARIANTS
 1285                 panic("carp: VHID %u@%s: master_down event in %s state\n",
 1286                     sc->sc_vhid,
 1287                     sc->sc_carpdev->if_xname,
 1288                     sc->sc_state ? "MASTER" : "INIT");
 1289 #endif
 1290                 break;
 1291         }
 1292 }
 1293 
 1294 /*
 1295  * When in backup state, af indicates whether to reset the master down timer
 1296  * for v4 or v6. If it's set to zero, reset the ones which are already pending.
 1297  */
 1298 static void
 1299 carp_setrun(struct carp_softc *sc, sa_family_t af)
 1300 {
 1301         struct timeval tv;
 1302 
 1303         CARP_LOCK_ASSERT(sc);
 1304 
 1305         if ((sc->sc_carpdev->if_flags & IFF_UP) == 0 ||
 1306             sc->sc_carpdev->if_link_state != LINK_STATE_UP ||
 1307             (sc->sc_naddrs == 0 && sc->sc_naddrs6 == 0) ||
 1308             !V_carp_allow)
 1309                 return;
 1310 
 1311         switch (sc->sc_state) {
 1312         case INIT:
 1313                 carp_set_state(sc, BACKUP, "initialization complete");
 1314                 carp_setrun(sc, 0);
 1315                 break;
 1316         case BACKUP:
 1317                 callout_stop(&sc->sc_ad_tmo);
 1318                 tv.tv_sec = 3 * sc->sc_advbase;
 1319                 tv.tv_usec = sc->sc_advskew * 1000000 / 256;
 1320                 switch (af) {
 1321 #ifdef INET
 1322                 case AF_INET:
 1323                         callout_reset(&sc->sc_md_tmo, tvtohz(&tv),
 1324                             carp_master_down, sc);
 1325                         break;
 1326 #endif
 1327 #ifdef INET6
 1328                 case AF_INET6:
 1329                         callout_reset(&sc->sc_md6_tmo, tvtohz(&tv),
 1330                             carp_master_down, sc);
 1331                         break;
 1332 #endif
 1333                 default:
 1334 #ifdef INET
 1335                         if (sc->sc_naddrs)
 1336                                 callout_reset(&sc->sc_md_tmo, tvtohz(&tv),
 1337                                     carp_master_down, sc);
 1338 #endif
 1339 #ifdef INET6
 1340                         if (sc->sc_naddrs6)
 1341                                 callout_reset(&sc->sc_md6_tmo, tvtohz(&tv),
 1342                                     carp_master_down, sc);
 1343 #endif
 1344                         break;
 1345                 }
 1346                 break;
 1347         case MASTER:
 1348                 tv.tv_sec = sc->sc_advbase;
 1349                 tv.tv_usec = sc->sc_advskew * 1000000 / 256;
 1350                 callout_reset(&sc->sc_ad_tmo, tvtohz(&tv),
 1351                     carp_send_ad, sc);
 1352                 break;
 1353         }
 1354 }
 1355 
 1356 /*
 1357  * Setup multicast structures.
 1358  */
 1359 static int
 1360 carp_multicast_setup(struct carp_if *cif, sa_family_t sa)
 1361 {
 1362         struct ifnet *ifp = cif->cif_ifp;
 1363         int error = 0;
 1364 
 1365         switch (sa) {
 1366 #ifdef INET
 1367         case AF_INET:
 1368             {
 1369                 struct ip_moptions *imo = &cif->cif_imo;
 1370                 struct in_addr addr;
 1371 
 1372                 if (imo->imo_membership)
 1373                         return (0);
 1374 
 1375                 imo->imo_membership = (struct in_multi **)malloc(
 1376                     (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_CARP,
 1377                     M_WAITOK);
 1378                 imo->imo_mfilters = NULL;
 1379                 imo->imo_max_memberships = IP_MIN_MEMBERSHIPS;
 1380                 imo->imo_multicast_vif = -1;
 1381 
 1382                 addr.s_addr = htonl(INADDR_CARP_GROUP);
 1383                 if ((error = in_joingroup(ifp, &addr, NULL,
 1384                     &imo->imo_membership[0])) != 0) {
 1385                         free(imo->imo_membership, M_CARP);
 1386                         break;
 1387                 }
 1388                 imo->imo_num_memberships++;
 1389                 imo->imo_multicast_ifp = ifp;
 1390                 imo->imo_multicast_ttl = CARP_DFLTTL;
 1391                 imo->imo_multicast_loop = 0;
 1392                 break;
 1393            }
 1394 #endif
 1395 #ifdef INET6
 1396         case AF_INET6:
 1397             {
 1398                 struct ip6_moptions *im6o = &cif->cif_im6o;
 1399                 struct in6_addr in6;
 1400                 struct in6_multi *in6m;
 1401 
 1402                 if (im6o->im6o_membership)
 1403                         return (0);
 1404 
 1405                 im6o->im6o_membership = (struct in6_multi **)malloc(
 1406                     (sizeof(struct in6_multi *) * IPV6_MIN_MEMBERSHIPS), M_CARP,
 1407                     M_ZERO | M_WAITOK);
 1408                 im6o->im6o_mfilters = NULL;
 1409                 im6o->im6o_max_memberships = IPV6_MIN_MEMBERSHIPS;
 1410                 im6o->im6o_multicast_hlim = CARP_DFLTTL;
 1411                 im6o->im6o_multicast_ifp = ifp;
 1412 
 1413                 /* Join IPv6 CARP multicast group. */
 1414                 bzero(&in6, sizeof(in6));
 1415                 in6.s6_addr16[0] = htons(0xff02);
 1416                 in6.s6_addr8[15] = 0x12;
 1417                 if ((error = in6_setscope(&in6, ifp, NULL)) != 0) {
 1418                         free(im6o->im6o_membership, M_CARP);
 1419                         break;
 1420                 }
 1421                 in6m = NULL;
 1422                 if ((error = in6_joingroup(ifp, &in6, NULL, &in6m, 0)) != 0) {
 1423                         free(im6o->im6o_membership, M_CARP);
 1424                         break;
 1425                 }
 1426                 in6m_acquire(in6m);
 1427                 im6o->im6o_membership[0] = in6m;
 1428                 im6o->im6o_num_memberships++;
 1429 
 1430                 /* Join solicited multicast address. */
 1431                 bzero(&in6, sizeof(in6));
 1432                 in6.s6_addr16[0] = htons(0xff02);
 1433                 in6.s6_addr32[1] = 0;
 1434                 in6.s6_addr32[2] = htonl(1);
 1435                 in6.s6_addr32[3] = 0;
 1436                 in6.s6_addr8[12] = 0xff;
 1437                 if ((error = in6_setscope(&in6, ifp, NULL)) != 0) {
 1438                         in6_leavegroup(im6o->im6o_membership[0], NULL);
 1439                         free(im6o->im6o_membership, M_CARP);
 1440                         break;
 1441                 }
 1442                 in6m = NULL;
 1443                 if ((error = in6_joingroup(ifp, &in6, NULL, &in6m, 0)) != 0) {
 1444                         in6_leavegroup(im6o->im6o_membership[0], NULL);
 1445                         free(im6o->im6o_membership, M_CARP);
 1446                         break;
 1447                 }
 1448                 in6m_acquire(in6m);
 1449                 im6o->im6o_membership[1] = in6m;
 1450                 im6o->im6o_num_memberships++;
 1451                 break;
 1452             }
 1453 #endif
 1454         }
 1455 
 1456         return (error);
 1457 }
 1458 
 1459 /*
 1460  * Free multicast structures.
 1461  */
 1462 static void
 1463 carp_multicast_cleanup(struct carp_if *cif, sa_family_t sa)
 1464 {
 1465 
 1466         sx_assert(&carp_sx, SA_XLOCKED);
 1467 
 1468         switch (sa) {
 1469 #ifdef INET
 1470         case AF_INET:
 1471                 if (cif->cif_naddrs == 0) {
 1472                         struct ip_moptions *imo = &cif->cif_imo;
 1473 
 1474                         in_leavegroup(imo->imo_membership[0], NULL);
 1475                         KASSERT(imo->imo_mfilters == NULL,
 1476                             ("%s: imo_mfilters != NULL", __func__));
 1477                         free(imo->imo_membership, M_CARP);
 1478                         imo->imo_membership = NULL;
 1479 
 1480                 }
 1481                 break;
 1482 #endif
 1483 #ifdef INET6
 1484         case AF_INET6:
 1485                 if (cif->cif_naddrs6 == 0) {
 1486                         struct ip6_moptions *im6o = &cif->cif_im6o;
 1487 
 1488                         in6_leavegroup(im6o->im6o_membership[0], NULL);
 1489                         in6_leavegroup(im6o->im6o_membership[1], NULL);
 1490                         KASSERT(im6o->im6o_mfilters == NULL,
 1491                             ("%s: im6o_mfilters != NULL", __func__));
 1492                         free(im6o->im6o_membership, M_CARP);
 1493                         im6o->im6o_membership = NULL;
 1494                 }
 1495                 break;
 1496 #endif
 1497         }
 1498 }
 1499 
 1500 int
 1501 carp_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *sa)
 1502 {
 1503         struct m_tag *mtag;
 1504         struct carp_softc *sc;
 1505 
 1506         if (!sa)
 1507                 return (0);
 1508 
 1509         switch (sa->sa_family) {
 1510 #ifdef INET
 1511         case AF_INET:
 1512                 break;
 1513 #endif
 1514 #ifdef INET6
 1515         case AF_INET6:
 1516                 break;
 1517 #endif
 1518         default:
 1519                 return (0);
 1520         }
 1521 
 1522         mtag = m_tag_find(m, PACKET_TAG_CARP, NULL);
 1523         if (mtag == NULL)
 1524                 return (0);
 1525 
 1526         bcopy(mtag + 1, &sc, sizeof(sc));
 1527 
 1528         /* Set the source MAC address to the Virtual Router MAC Address. */
 1529         switch (ifp->if_type) {
 1530         case IFT_ETHER:
 1531         case IFT_BRIDGE:
 1532         case IFT_L2VLAN: {
 1533                         struct ether_header *eh;
 1534 
 1535                         eh = mtod(m, struct ether_header *);
 1536                         eh->ether_shost[0] = 0;
 1537                         eh->ether_shost[1] = 0;
 1538                         eh->ether_shost[2] = 0x5e;
 1539                         eh->ether_shost[3] = 0;
 1540                         eh->ether_shost[4] = 1;
 1541                         eh->ether_shost[5] = sc->sc_vhid;
 1542                 }
 1543                 break;
 1544         default:
 1545                 printf("%s: carp is not supported for the %d interface type\n",
 1546                     ifp->if_xname, ifp->if_type);
 1547                 return (EOPNOTSUPP);
 1548         }
 1549 
 1550         return (0);
 1551 }
 1552 
 1553 static struct carp_softc*
 1554 carp_alloc(struct ifnet *ifp)
 1555 {
 1556         struct carp_softc *sc;
 1557         struct carp_if *cif;
 1558 
 1559         sx_assert(&carp_sx, SA_XLOCKED);
 1560 
 1561         if ((cif = ifp->if_carp) == NULL)
 1562                 cif = carp_alloc_if(ifp);
 1563 
 1564         sc = malloc(sizeof(*sc), M_CARP, M_WAITOK|M_ZERO);
 1565 
 1566         sc->sc_advbase = CARP_DFLTINTV;
 1567         sc->sc_vhid = -1;       /* required setting */
 1568         sc->sc_init_counter = 1;
 1569         sc->sc_state = INIT;
 1570 
 1571         sc->sc_ifasiz = sizeof(struct ifaddr *);
 1572         sc->sc_ifas = malloc(sc->sc_ifasiz, M_CARP, M_WAITOK|M_ZERO);
 1573         sc->sc_carpdev = ifp;
 1574 
 1575         CARP_LOCK_INIT(sc);
 1576 #ifdef INET
 1577         callout_init_mtx(&sc->sc_md_tmo, &sc->sc_mtx, CALLOUT_RETURNUNLOCKED);
 1578 #endif
 1579 #ifdef INET6
 1580         callout_init_mtx(&sc->sc_md6_tmo, &sc->sc_mtx, CALLOUT_RETURNUNLOCKED);
 1581 #endif
 1582         callout_init_mtx(&sc->sc_ad_tmo, &sc->sc_mtx, CALLOUT_RETURNUNLOCKED);
 1583 
 1584         CIF_LOCK(cif);
 1585         TAILQ_INSERT_TAIL(&cif->cif_vrs, sc, sc_list);
 1586         CIF_UNLOCK(cif);
 1587 
 1588         mtx_lock(&carp_mtx);
 1589         LIST_INSERT_HEAD(&carp_list, sc, sc_next);
 1590         mtx_unlock(&carp_mtx);
 1591 
 1592         return (sc);
 1593 }
 1594 
 1595 static void
 1596 carp_grow_ifas(struct carp_softc *sc)
 1597 {
 1598         struct ifaddr **new;
 1599 
 1600         new = malloc(sc->sc_ifasiz * 2, M_CARP, M_WAITOK | M_ZERO);
 1601         CARP_LOCK(sc);
 1602         bcopy(sc->sc_ifas, new, sc->sc_ifasiz);
 1603         free(sc->sc_ifas, M_CARP);
 1604         sc->sc_ifas = new;
 1605         sc->sc_ifasiz *= 2;
 1606         CARP_UNLOCK(sc);
 1607 }
 1608 
 1609 static void
 1610 carp_destroy(struct carp_softc *sc)
 1611 {
 1612         struct ifnet *ifp = sc->sc_carpdev;
 1613         struct carp_if *cif = ifp->if_carp;
 1614 
 1615         sx_assert(&carp_sx, SA_XLOCKED);
 1616 
 1617         if (sc->sc_suppress)
 1618                 carp_demote_adj(-V_carp_ifdown_adj, "vhid removed");
 1619         CARP_UNLOCK(sc);
 1620 
 1621         CIF_LOCK(cif);
 1622         TAILQ_REMOVE(&cif->cif_vrs, sc, sc_list);
 1623         CIF_UNLOCK(cif);
 1624 
 1625         mtx_lock(&carp_mtx);
 1626         LIST_REMOVE(sc, sc_next);
 1627         mtx_unlock(&carp_mtx);
 1628 
 1629         callout_drain(&sc->sc_ad_tmo);
 1630 #ifdef INET
 1631         callout_drain(&sc->sc_md_tmo);
 1632 #endif
 1633 #ifdef INET6
 1634         callout_drain(&sc->sc_md6_tmo);
 1635 #endif
 1636         CARP_LOCK_DESTROY(sc);
 1637 
 1638         free(sc->sc_ifas, M_CARP);
 1639         free(sc, M_CARP);
 1640 }
 1641 
 1642 static struct carp_if*
 1643 carp_alloc_if(struct ifnet *ifp)
 1644 {
 1645         struct carp_if *cif;
 1646         int error;
 1647 
 1648         cif = malloc(sizeof(*cif), M_CARP, M_WAITOK|M_ZERO);
 1649 
 1650         if ((error = ifpromisc(ifp, 1)) != 0)
 1651                 printf("%s: ifpromisc(%s) failed: %d\n",
 1652                     __func__, ifp->if_xname, error);
 1653         else
 1654                 cif->cif_flags |= CIF_PROMISC;
 1655 
 1656         CIF_LOCK_INIT(cif);
 1657         cif->cif_ifp = ifp;
 1658         TAILQ_INIT(&cif->cif_vrs);
 1659 
 1660         IF_ADDR_WLOCK(ifp);
 1661         ifp->if_carp = cif;
 1662         if_ref(ifp);
 1663         IF_ADDR_WUNLOCK(ifp);
 1664 
 1665         return (cif);
 1666 }
 1667 
 1668 static void
 1669 carp_free_if(struct carp_if *cif)
 1670 {
 1671         struct ifnet *ifp = cif->cif_ifp;
 1672 
 1673         CIF_LOCK_ASSERT(cif);
 1674         KASSERT(TAILQ_EMPTY(&cif->cif_vrs), ("%s: softc list not empty",
 1675             __func__));
 1676 
 1677         IF_ADDR_WLOCK(ifp);
 1678         ifp->if_carp = NULL;
 1679         IF_ADDR_WUNLOCK(ifp);
 1680 
 1681         CIF_LOCK_DESTROY(cif);
 1682 
 1683         if (cif->cif_flags & CIF_PROMISC)
 1684                 ifpromisc(ifp, 0);
 1685         if_rele(ifp);
 1686 
 1687         free(cif, M_CARP);
 1688 }
 1689 
 1690 static void
 1691 carp_carprcp(struct carpreq *carpr, struct carp_softc *sc, int priv)
 1692 {
 1693 
 1694         CARP_LOCK(sc);
 1695         carpr->carpr_state = sc->sc_state;
 1696         carpr->carpr_vhid = sc->sc_vhid;
 1697         carpr->carpr_advbase = sc->sc_advbase;
 1698         carpr->carpr_advskew = sc->sc_advskew;
 1699         if (priv)
 1700                 bcopy(sc->sc_key, carpr->carpr_key, sizeof(carpr->carpr_key));
 1701         else
 1702                 bzero(carpr->carpr_key, sizeof(carpr->carpr_key));
 1703         CARP_UNLOCK(sc);
 1704 }
 1705 
 1706 int
 1707 carp_ioctl(struct ifreq *ifr, u_long cmd, struct thread *td)
 1708 {
 1709         struct carpreq carpr;
 1710         struct ifnet *ifp;
 1711         struct carp_softc *sc = NULL;
 1712         int error = 0, locked = 0;
 1713 
 1714         if ((error = copyin(ifr_data_get_ptr(ifr), &carpr, sizeof carpr)))
 1715                 return (error);
 1716 
 1717         ifp = ifunit_ref(ifr->ifr_name);
 1718         if (ifp == NULL)
 1719                 return (ENXIO);
 1720 
 1721         switch (ifp->if_type) {
 1722         case IFT_ETHER:
 1723         case IFT_L2VLAN:
 1724         case IFT_BRIDGE:
 1725                 break;
 1726         default:
 1727                 error = EOPNOTSUPP;
 1728                 goto out;
 1729         }
 1730 
 1731         if ((ifp->if_flags & IFF_MULTICAST) == 0) {
 1732                 error = EADDRNOTAVAIL;
 1733                 goto out;
 1734         }
 1735 
 1736         sx_xlock(&carp_sx);
 1737         switch (cmd) {
 1738         case SIOCSVH:
 1739                 if ((error = priv_check(td, PRIV_NETINET_CARP)))
 1740                         break;
 1741                 if (carpr.carpr_vhid <= 0 || carpr.carpr_vhid > CARP_MAXVHID ||
 1742                     carpr.carpr_advbase < 0 || carpr.carpr_advskew < 0) {
 1743                         error = EINVAL;
 1744                         break;
 1745                 }
 1746 
 1747                 if (ifp->if_carp) {
 1748                         IFNET_FOREACH_CARP(ifp, sc)
 1749                                 if (sc->sc_vhid == carpr.carpr_vhid)
 1750                                         break;
 1751                 }
 1752                 if (sc == NULL) {
 1753                         sc = carp_alloc(ifp);
 1754                         CARP_LOCK(sc);
 1755                         sc->sc_vhid = carpr.carpr_vhid;
 1756                         LLADDR(&sc->sc_addr)[0] = 0;
 1757                         LLADDR(&sc->sc_addr)[1] = 0;
 1758                         LLADDR(&sc->sc_addr)[2] = 0x5e;
 1759                         LLADDR(&sc->sc_addr)[3] = 0;
 1760                         LLADDR(&sc->sc_addr)[4] = 1;
 1761                         LLADDR(&sc->sc_addr)[5] = sc->sc_vhid;
 1762                 } else
 1763                         CARP_LOCK(sc);
 1764                 locked = 1;
 1765                 if (carpr.carpr_advbase > 0) {
 1766                         if (carpr.carpr_advbase > 255 ||
 1767                             carpr.carpr_advbase < CARP_DFLTINTV) {
 1768                                 error = EINVAL;
 1769                                 break;
 1770                         }
 1771                         sc->sc_advbase = carpr.carpr_advbase;
 1772                 }
 1773                 if (carpr.carpr_advskew >= 255) {
 1774                         error = EINVAL;
 1775                         break;
 1776                 }
 1777                 sc->sc_advskew = carpr.carpr_advskew;
 1778                 if (carpr.carpr_key[0] != '\0') {
 1779                         bcopy(carpr.carpr_key, sc->sc_key, sizeof(sc->sc_key));
 1780                         carp_hmac_prepare(sc);
 1781                 }
 1782                 if (sc->sc_state != INIT &&
 1783                     carpr.carpr_state != sc->sc_state) {
 1784                         switch (carpr.carpr_state) {
 1785                         case BACKUP:
 1786                                 callout_stop(&sc->sc_ad_tmo);
 1787                                 carp_set_state(sc, BACKUP,
 1788                                     "user requested via ifconfig");
 1789                                 carp_setrun(sc, 0);
 1790                                 carp_delroute(sc);
 1791                                 break;
 1792                         case MASTER:
 1793                                 carp_master_down_locked(sc,
 1794                                     "user requested via ifconfig");
 1795                                 break;
 1796                         default:
 1797                                 break;
 1798                         }
 1799                 }
 1800                 break;
 1801 
 1802         case SIOCGVH:
 1803             {
 1804                 int priveleged;
 1805 
 1806                 if (carpr.carpr_vhid < 0 || carpr.carpr_vhid > CARP_MAXVHID) {
 1807                         error = EINVAL;
 1808                         break;
 1809                 }
 1810                 if (carpr.carpr_count < 1) {
 1811                         error = EMSGSIZE;
 1812                         break;
 1813                 }
 1814                 if (ifp->if_carp == NULL) {
 1815                         error = ENOENT;
 1816                         break;
 1817                 }
 1818 
 1819                 priveleged = (priv_check(td, PRIV_NETINET_CARP) == 0);
 1820                 if (carpr.carpr_vhid != 0) {
 1821                         IFNET_FOREACH_CARP(ifp, sc)
 1822                                 if (sc->sc_vhid == carpr.carpr_vhid)
 1823                                         break;
 1824                         if (sc == NULL) {
 1825                                 error = ENOENT;
 1826                                 break;
 1827                         }
 1828                         carp_carprcp(&carpr, sc, priveleged);
 1829                         error = copyout(&carpr, ifr_data_get_ptr(ifr),
 1830                             sizeof(carpr));
 1831                 } else  {
 1832                         int i, count;
 1833 
 1834                         count = 0;
 1835                         IFNET_FOREACH_CARP(ifp, sc)
 1836                                 count++;
 1837 
 1838                         if (count > carpr.carpr_count) {
 1839                                 CIF_UNLOCK(ifp->if_carp);
 1840                                 error = EMSGSIZE;
 1841                                 break;
 1842                         }
 1843 
 1844                         i = 0;
 1845                         IFNET_FOREACH_CARP(ifp, sc) {
 1846                                 carp_carprcp(&carpr, sc, priveleged);
 1847                                 carpr.carpr_count = count;
 1848                                 error = copyout(&carpr,
 1849                                     (caddr_t)ifr_data_get_ptr(ifr) +
 1850                                     (i * sizeof(carpr)), sizeof(carpr));
 1851                                 if (error) {
 1852                                         CIF_UNLOCK(ifp->if_carp);
 1853                                         break;
 1854                                 }
 1855                                 i++;
 1856                         }
 1857                 }
 1858                 break;
 1859             }
 1860         default:
 1861                 error = EINVAL;
 1862         }
 1863         sx_xunlock(&carp_sx);
 1864 
 1865 out:
 1866         if (locked)
 1867                 CARP_UNLOCK(sc);
 1868         if_rele(ifp);
 1869 
 1870         return (error);
 1871 }
 1872 
 1873 static int
 1874 carp_get_vhid(struct ifaddr *ifa)
 1875 {
 1876 
 1877         if (ifa == NULL || ifa->ifa_carp == NULL)
 1878                 return (0);
 1879 
 1880         return (ifa->ifa_carp->sc_vhid);
 1881 }
 1882 
 1883 int
 1884 carp_attach(struct ifaddr *ifa, int vhid)
 1885 {
 1886         struct ifnet *ifp = ifa->ifa_ifp;
 1887         struct carp_if *cif = ifp->if_carp;
 1888         struct carp_softc *sc;
 1889         int index, error;
 1890 
 1891         KASSERT(ifa->ifa_carp == NULL, ("%s: ifa %p attached", __func__, ifa));
 1892 
 1893         switch (ifa->ifa_addr->sa_family) {
 1894 #ifdef INET
 1895         case AF_INET:
 1896 #endif
 1897 #ifdef INET6
 1898         case AF_INET6:
 1899 #endif
 1900                 break;
 1901         default:
 1902                 return (EPROTOTYPE);
 1903         }
 1904 
 1905         sx_xlock(&carp_sx);
 1906         if (ifp->if_carp == NULL) {
 1907                 sx_xunlock(&carp_sx);
 1908                 return (ENOPROTOOPT);
 1909         }
 1910 
 1911         IFNET_FOREACH_CARP(ifp, sc)
 1912                 if (sc->sc_vhid == vhid)
 1913                         break;
 1914         if (sc == NULL) {
 1915                 sx_xunlock(&carp_sx);
 1916                 return (ENOENT);
 1917         }
 1918 
 1919         error = carp_multicast_setup(cif, ifa->ifa_addr->sa_family);
 1920         if (error) {
 1921                 CIF_FREE(cif);
 1922                 sx_xunlock(&carp_sx);
 1923                 return (error);
 1924         }
 1925 
 1926         index = sc->sc_naddrs + sc->sc_naddrs6 + 1;
 1927         if (index > sc->sc_ifasiz / sizeof(struct ifaddr *))
 1928                 carp_grow_ifas(sc);
 1929 
 1930         switch (ifa->ifa_addr->sa_family) {
 1931 #ifdef INET
 1932         case AF_INET:
 1933                 cif->cif_naddrs++;
 1934                 sc->sc_naddrs++;
 1935                 break;
 1936 #endif
 1937 #ifdef INET6
 1938         case AF_INET6:
 1939                 cif->cif_naddrs6++;
 1940                 sc->sc_naddrs6++;
 1941                 break;
 1942 #endif
 1943         }
 1944 
 1945         ifa_ref(ifa);
 1946 
 1947         CARP_LOCK(sc);
 1948         sc->sc_ifas[index - 1] = ifa;
 1949         ifa->ifa_carp = sc;
 1950         carp_hmac_prepare(sc);
 1951         carp_sc_state(sc);
 1952         CARP_UNLOCK(sc);
 1953 
 1954         sx_xunlock(&carp_sx);
 1955 
 1956         return (0);
 1957 }
 1958 
 1959 void
 1960 carp_detach(struct ifaddr *ifa, bool keep_cif)
 1961 {
 1962         struct ifnet *ifp = ifa->ifa_ifp;
 1963         struct carp_if *cif = ifp->if_carp;
 1964         struct carp_softc *sc = ifa->ifa_carp;
 1965         int i, index;
 1966 
 1967         KASSERT(sc != NULL, ("%s: %p not attached", __func__, ifa));
 1968 
 1969         sx_xlock(&carp_sx);
 1970 
 1971         CARP_LOCK(sc);
 1972         /* Shift array. */
 1973         index = sc->sc_naddrs + sc->sc_naddrs6;
 1974         for (i = 0; i < index; i++)
 1975                 if (sc->sc_ifas[i] == ifa)
 1976                         break;
 1977         KASSERT(i < index, ("%s: %p no backref", __func__, ifa));
 1978         for (; i < index - 1; i++)
 1979                 sc->sc_ifas[i] = sc->sc_ifas[i+1];
 1980         sc->sc_ifas[index - 1] = NULL;
 1981 
 1982         switch (ifa->ifa_addr->sa_family) {
 1983 #ifdef INET
 1984         case AF_INET:
 1985                 cif->cif_naddrs--;
 1986                 sc->sc_naddrs--;
 1987                 break;
 1988 #endif
 1989 #ifdef INET6
 1990         case AF_INET6:
 1991                 cif->cif_naddrs6--;
 1992                 sc->sc_naddrs6--;
 1993                 break;
 1994 #endif
 1995         }
 1996 
 1997         carp_ifa_delroute(ifa);
 1998         carp_multicast_cleanup(cif, ifa->ifa_addr->sa_family);
 1999 
 2000         ifa->ifa_carp = NULL;
 2001         ifa_free(ifa);
 2002 
 2003         carp_hmac_prepare(sc);
 2004         carp_sc_state(sc);
 2005 
 2006         if (!keep_cif && sc->sc_naddrs == 0 && sc->sc_naddrs6 == 0)
 2007                 carp_destroy(sc);
 2008         else
 2009                 CARP_UNLOCK(sc);
 2010 
 2011         if (!keep_cif)
 2012                 CIF_FREE(cif);
 2013 
 2014         sx_xunlock(&carp_sx);
 2015 }
 2016 
 2017 static void
 2018 carp_set_state(struct carp_softc *sc, int state, const char *reason)
 2019 {
 2020 
 2021         CARP_LOCK_ASSERT(sc);
 2022 
 2023         if (sc->sc_state != state) {
 2024                 const char *carp_states[] = { CARP_STATES };
 2025                 char subsys[IFNAMSIZ+5];
 2026 
 2027                 snprintf(subsys, IFNAMSIZ+5, "%u@%s", sc->sc_vhid,
 2028                     sc->sc_carpdev->if_xname);
 2029 
 2030                 CARP_LOG("%s: %s -> %s (%s)\n", subsys,
 2031                     carp_states[sc->sc_state], carp_states[state], reason);
 2032 
 2033                 sc->sc_state = state;
 2034 
 2035                 devctl_notify("CARP", subsys, carp_states[state], NULL);
 2036         }
 2037 }
 2038 
 2039 static void
 2040 carp_linkstate(struct ifnet *ifp)
 2041 {
 2042         struct carp_softc *sc;
 2043 
 2044         CIF_LOCK(ifp->if_carp);
 2045         IFNET_FOREACH_CARP(ifp, sc) {
 2046                 CARP_LOCK(sc);
 2047                 carp_sc_state(sc);
 2048                 CARP_UNLOCK(sc);
 2049         }
 2050         CIF_UNLOCK(ifp->if_carp);
 2051 }
 2052 
 2053 static void
 2054 carp_sc_state(struct carp_softc *sc)
 2055 {
 2056 
 2057         CARP_LOCK_ASSERT(sc);
 2058 
 2059         if (sc->sc_carpdev->if_link_state != LINK_STATE_UP ||
 2060             !(sc->sc_carpdev->if_flags & IFF_UP) ||
 2061             !V_carp_allow) {
 2062                 callout_stop(&sc->sc_ad_tmo);
 2063 #ifdef INET
 2064                 callout_stop(&sc->sc_md_tmo);
 2065 #endif
 2066 #ifdef INET6
 2067                 callout_stop(&sc->sc_md6_tmo);
 2068 #endif
 2069                 carp_set_state(sc, INIT, "hardware interface down");
 2070                 carp_setrun(sc, 0);
 2071                 if (!sc->sc_suppress)
 2072                         carp_demote_adj(V_carp_ifdown_adj, "interface down");
 2073                 sc->sc_suppress = 1;
 2074         } else {
 2075                 carp_set_state(sc, INIT, "hardware interface up");
 2076                 carp_setrun(sc, 0);
 2077                 if (sc->sc_suppress)
 2078                         carp_demote_adj(-V_carp_ifdown_adj, "interface up");
 2079                 sc->sc_suppress = 0;
 2080         }
 2081 }
 2082 
 2083 static void
 2084 carp_demote_adj(int adj, char *reason)
 2085 {
 2086         atomic_add_int(&V_carp_demotion, adj);
 2087         CARP_LOG("demoted by %d to %d (%s)\n", adj, V_carp_demotion, reason);
 2088         taskqueue_enqueue(taskqueue_swi, &carp_sendall_task);
 2089 }
 2090 
 2091 static int
 2092 carp_allow_sysctl(SYSCTL_HANDLER_ARGS)
 2093 {
 2094         int new, error;
 2095         struct carp_softc *sc;
 2096 
 2097         new = V_carp_allow;
 2098         error = sysctl_handle_int(oidp, &new, 0, req);
 2099         if (error || !req->newptr)
 2100                 return (error);
 2101 
 2102         if (V_carp_allow != new) {
 2103                 V_carp_allow = new;
 2104 
 2105                 mtx_lock(&carp_mtx);
 2106                 LIST_FOREACH(sc, &carp_list, sc_next) {
 2107                         CARP_LOCK(sc);
 2108                         if (curvnet == sc->sc_carpdev->if_vnet)
 2109                                 carp_sc_state(sc);
 2110                         CARP_UNLOCK(sc);
 2111                 }
 2112                 mtx_unlock(&carp_mtx);
 2113         }
 2114 
 2115         return (0);
 2116 }
 2117 
 2118 static int
 2119 carp_dscp_sysctl(SYSCTL_HANDLER_ARGS)
 2120 {
 2121         int new, error;
 2122 
 2123         new = V_carp_dscp;
 2124         error = sysctl_handle_int(oidp, &new, 0, req);
 2125         if (error || !req->newptr)
 2126                 return (error);
 2127 
 2128         if (new < 0 || new > 63)
 2129                 return (EINVAL);
 2130 
 2131         V_carp_dscp = new;
 2132 
 2133         return (0);
 2134 }
 2135 
 2136 static int
 2137 carp_demote_adj_sysctl(SYSCTL_HANDLER_ARGS)
 2138 {
 2139         int new, error;
 2140 
 2141         new = V_carp_demotion;
 2142         error = sysctl_handle_int(oidp, &new, 0, req);
 2143         if (error || !req->newptr)
 2144                 return (error);
 2145 
 2146         carp_demote_adj(new, "sysctl");
 2147 
 2148         return (0);
 2149 }
 2150 
 2151 #ifdef INET
 2152 extern  struct domain inetdomain;
 2153 static struct protosw in_carp_protosw = {
 2154         .pr_type =              SOCK_RAW,
 2155         .pr_domain =            &inetdomain,
 2156         .pr_protocol =          IPPROTO_CARP,
 2157         .pr_flags =             PR_ATOMIC|PR_ADDR,
 2158         .pr_input =             carp_input,
 2159         .pr_output =            rip_output,
 2160         .pr_ctloutput =         rip_ctloutput,
 2161         .pr_usrreqs =           &rip_usrreqs
 2162 };
 2163 #endif
 2164 
 2165 #ifdef INET6
 2166 extern  struct domain inet6domain;
 2167 static struct protosw in6_carp_protosw = {
 2168         .pr_type =              SOCK_RAW,
 2169         .pr_domain =            &inet6domain,
 2170         .pr_protocol =          IPPROTO_CARP,
 2171         .pr_flags =             PR_ATOMIC|PR_ADDR,
 2172         .pr_input =             carp6_input,
 2173         .pr_output =            rip6_output,
 2174         .pr_ctloutput =         rip6_ctloutput,
 2175         .pr_usrreqs =           &rip6_usrreqs
 2176 };
 2177 #endif
 2178 
 2179 #ifdef VIMAGE
 2180 #if defined(__i386__)
 2181 /*
 2182  * XXX This is a hack to work around an absolute relocation outside
 2183  * set_vnet by one (on the stop symbol) for carpstats.  Add a dummy variable
 2184  * to the end of the file in the hope that the linker will just keep the
 2185  * order (as it seems to do at the moment).  It is understood to be fragile.
 2186  * See PR 230857 for a longer discussion of the problem and the referenced
 2187  * review for possible alternate solutions.  Each is a hack; we just need
 2188  * the least intrusive one for the next release.
 2189  */
 2190 VNET_DEFINE(char, carp_zzz) = 0xde;
 2191 #endif
 2192 #endif
 2193 
 2194 static void
 2195 carp_mod_cleanup(void)
 2196 {
 2197 
 2198 #ifdef INET
 2199         if (proto_reg[CARP_INET] == 0) {
 2200                 (void)ipproto_unregister(IPPROTO_CARP);
 2201                 pf_proto_unregister(PF_INET, IPPROTO_CARP, SOCK_RAW);
 2202                 proto_reg[CARP_INET] = -1;
 2203         }
 2204         carp_iamatch_p = NULL;
 2205 #endif
 2206 #ifdef INET6
 2207         if (proto_reg[CARP_INET6] == 0) {
 2208                 (void)ip6proto_unregister(IPPROTO_CARP);
 2209                 pf_proto_unregister(PF_INET6, IPPROTO_CARP, SOCK_RAW);
 2210                 proto_reg[CARP_INET6] = -1;
 2211         }
 2212         carp_iamatch6_p = NULL;
 2213         carp_macmatch6_p = NULL;
 2214 #endif
 2215         carp_ioctl_p = NULL;
 2216         carp_attach_p = NULL;
 2217         carp_detach_p = NULL;
 2218         carp_get_vhid_p = NULL;
 2219         carp_linkstate_p = NULL;
 2220         carp_forus_p = NULL;
 2221         carp_output_p = NULL;
 2222         carp_demote_adj_p = NULL;
 2223         carp_master_p = NULL;
 2224         mtx_unlock(&carp_mtx);
 2225         taskqueue_drain(taskqueue_swi, &carp_sendall_task);
 2226         mtx_destroy(&carp_mtx);
 2227         sx_destroy(&carp_sx);
 2228 }
 2229 
 2230 static int
 2231 carp_mod_load(void)
 2232 {
 2233         int err;
 2234 
 2235         mtx_init(&carp_mtx, "carp_mtx", NULL, MTX_DEF);
 2236         sx_init(&carp_sx, "carp_sx");
 2237         LIST_INIT(&carp_list);
 2238         carp_get_vhid_p = carp_get_vhid;
 2239         carp_forus_p = carp_forus;
 2240         carp_output_p = carp_output;
 2241         carp_linkstate_p = carp_linkstate;
 2242         carp_ioctl_p = carp_ioctl;
 2243         carp_attach_p = carp_attach;
 2244         carp_detach_p = carp_detach;
 2245         carp_demote_adj_p = carp_demote_adj;
 2246         carp_master_p = carp_master;
 2247 #ifdef INET6
 2248         carp_iamatch6_p = carp_iamatch6;
 2249         carp_macmatch6_p = carp_macmatch6;
 2250         proto_reg[CARP_INET6] = pf_proto_register(PF_INET6,
 2251             (struct protosw *)&in6_carp_protosw);
 2252         if (proto_reg[CARP_INET6]) {
 2253                 printf("carp: error %d attaching to PF_INET6\n",
 2254                     proto_reg[CARP_INET6]);
 2255                 carp_mod_cleanup();
 2256                 return (proto_reg[CARP_INET6]);
 2257         }
 2258         err = ip6proto_register(IPPROTO_CARP);
 2259         if (err) {
 2260                 printf("carp: error %d registering with INET6\n", err);
 2261                 carp_mod_cleanup();
 2262                 return (err);
 2263         }
 2264 #endif
 2265 #ifdef INET
 2266         carp_iamatch_p = carp_iamatch;
 2267         proto_reg[CARP_INET] = pf_proto_register(PF_INET, &in_carp_protosw);
 2268         if (proto_reg[CARP_INET]) {
 2269                 printf("carp: error %d attaching to PF_INET\n",
 2270                     proto_reg[CARP_INET]);
 2271                 carp_mod_cleanup();
 2272                 return (proto_reg[CARP_INET]);
 2273         }
 2274         err = ipproto_register(IPPROTO_CARP);
 2275         if (err) {
 2276                 printf("carp: error %d registering with INET\n", err);
 2277                 carp_mod_cleanup();
 2278                 return (err);
 2279         }
 2280 #endif
 2281         return (0);
 2282 }
 2283 
 2284 static int
 2285 carp_modevent(module_t mod, int type, void *data)
 2286 {
 2287         switch (type) {
 2288         case MOD_LOAD:
 2289                 return carp_mod_load();
 2290                 /* NOTREACHED */
 2291         case MOD_UNLOAD:
 2292                 mtx_lock(&carp_mtx);
 2293                 if (LIST_EMPTY(&carp_list))
 2294                         carp_mod_cleanup();
 2295                 else {
 2296                         mtx_unlock(&carp_mtx);
 2297                         return (EBUSY);
 2298                 }
 2299                 break;
 2300 
 2301         default:
 2302                 return (EINVAL);
 2303         }
 2304 
 2305         return (0);
 2306 }
 2307 
 2308 static moduledata_t carp_mod = {
 2309         "carp",
 2310         carp_modevent,
 2311         0
 2312 };
 2313 
 2314 DECLARE_MODULE(carp, carp_mod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);

Cache object: 5cf44408148903e3cf0f70e49355d7bd


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.