Add initial support for pf state synchronization over the network.

Implemented as an in-kernel multicast IP protocol.

Turn it on like this:

# ifconfig pfsync0 up syncif fxp0

There is not yet any authentication on this protocol, so the syncif
must be on a trusted network. ie, a crossover cable between the two
firewalls.

NOTABLE CHANGES:
- A new index based on a unique (creatorid, stateid) tuple has been
  added to the state tree.
- Updates now appear on the pfsync(4) interface; multiple updates may
  be compressed into a single update.
- Applications which use bpf on pfsync(4) will need modification;
  packets on pfsync no longer contains regular pf_state structs,
  but pfsync_state structs which contain no pointers.

Much more to come.

ok deraadt@

1 files changed, 2 insertions, 1 deletions

diff --git a/usr.bin/netstat/netstat.h b/usr.bin/netstat/netstat.h
index 10bd073b5b5..7c7a487110d 100644
--- a/usr.bin/netstat/netstat.h
+++ b/usr.bin/netstat/netstat.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: netstat.h,v 1.26 2003/10/17 21:04:59 mcbride Exp $	*/
+/*	$OpenBSD: netstat.h,v 1.27 2003/12/15 07:11:31 mcbride Exp $	*/
 /*	$NetBSD: netstat.h,v 1.6 1996/05/07 02:55:05 thorpej Exp $	*/
 
 /*
@@ -79,6 +79,7 @@ void	ah_stats(u_long, char *);
 void	esp_stats(u_long, char *);
 void	ipip_stats(u_long, char *);
 void	carp_stats (u_long, char *);
+void	pfsync_stats (u_long, char *);
 void	etherip_stats(u_long, char *);
 void	protopr(u_long, char *);
 void	ipcomp_stats(u_long, char *);