ng_tcpmss.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * ng_tcpmss.c
    3  *
    4  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    5  *
    6  * Copyright (c) 2004, Alexey Popov <lollypop@flexuser.ru>
    7  * All rights reserved.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice unmodified, this list of conditions, and the following
   14  *    disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   29  * SUCH DAMAGE.
   30  *
   31  * This software includes fragments of the following programs:
   32  *      tcpmssd         Ruslan Ermilov <ru@FreeBSD.org>
   33  *
   34  * $FreeBSD: releng/12.0/sys/netgraph/ng_tcpmss.c 326272 2017-11-27 15:23:17Z pfg $
   35  */
   36 
   37 /*
   38  * This node is netgraph tool for workaround of PMTUD problem. It acts
   39  * like filter for IP packets. If configured, it reduces MSS of TCP SYN
   40  * packets.
   41  *
   42  * Configuration can be done by sending NGM_TCPMSS_CONFIG message. The
   43  * message sets filter for incoming packets on hook 'inHook'. Packet's
   44  * TCP MSS field is lowered to 'maxMSS' parameter and resulting packet
   45  * is sent to 'outHook'.
   46  *
   47  * XXX: statistics are updated not atomically, so they may broke on SMP.
   48  */
   49 
   50 #include <sys/param.h>
   51 #include <sys/systm.h>
   52 #include <sys/endian.h>
   53 #include <sys/errno.h>
   54 #include <sys/kernel.h>
   55 #include <sys/malloc.h>
   56 #include <sys/mbuf.h>
   57 
   58 #include <netinet/in.h>
   59 #include <netinet/in_systm.h>
   60 #include <netinet/ip.h>
   61 #include <netinet/tcp.h>
   62 
   63 #include <netgraph/ng_message.h>
   64 #include <netgraph/netgraph.h>
   65 #include <netgraph/ng_parse.h>
   66 #include <netgraph/ng_tcpmss.h>
   67 
   68 /* Per hook info. */
   69 typedef struct {
   70         hook_p                          outHook;
   71         struct ng_tcpmss_hookstat       stats;
   72 } *hpriv_p;
   73 
   74 /* Netgraph methods. */
   75 static ng_constructor_t ng_tcpmss_constructor;
   76 static ng_rcvmsg_t      ng_tcpmss_rcvmsg;
   77 static ng_newhook_t     ng_tcpmss_newhook;
   78 static ng_rcvdata_t     ng_tcpmss_rcvdata;
   79 static ng_disconnect_t  ng_tcpmss_disconnect;
   80 
   81 static int correct_mss(struct tcphdr *, int, uint16_t, int);
   82 
   83 /* Parse type for struct ng_tcpmss_hookstat. */
   84 static const struct ng_parse_struct_field ng_tcpmss_hookstat_type_fields[]
   85         = NG_TCPMSS_HOOKSTAT_INFO;
   86 static const struct ng_parse_type ng_tcpmss_hookstat_type = {
   87         &ng_parse_struct_type,
   88         &ng_tcpmss_hookstat_type_fields
   89 };
   90 
   91 /* Parse type for struct ng_tcpmss_config. */
   92 static const struct ng_parse_struct_field ng_tcpmss_config_type_fields[]
   93         = NG_TCPMSS_CONFIG_INFO;
   94 static const struct ng_parse_type ng_tcpmss_config_type = {
   95         &ng_parse_struct_type,
   96         ng_tcpmss_config_type_fields
   97 };
   98 
   99 /* List of commands and how to convert arguments to/from ASCII. */
  100 static const struct ng_cmdlist ng_tcpmss_cmds[] = {
  101         {
  102           NGM_TCPMSS_COOKIE,
  103           NGM_TCPMSS_GET_STATS,
  104           "getstats",
  105           &ng_parse_hookbuf_type,
  106           &ng_tcpmss_hookstat_type
  107         },
  108         {
  109           NGM_TCPMSS_COOKIE,
  110           NGM_TCPMSS_CLR_STATS,
  111           "clrstats",
  112           &ng_parse_hookbuf_type,
  113           NULL
  114         },
  115         {
  116           NGM_TCPMSS_COOKIE,
  117           NGM_TCPMSS_GETCLR_STATS,
  118           "getclrstats",
  119           &ng_parse_hookbuf_type,
  120           &ng_tcpmss_hookstat_type
  121         },
  122         {
  123           NGM_TCPMSS_COOKIE,
  124           NGM_TCPMSS_CONFIG,
  125           "config",
  126           &ng_tcpmss_config_type,
  127           NULL
  128         },
  129         { 0 }
  130 };
  131 
  132 /* Netgraph type descriptor. */
  133 static struct ng_type ng_tcpmss_typestruct = {
  134         .version =      NG_ABI_VERSION,
  135         .name =         NG_TCPMSS_NODE_TYPE,
  136         .constructor =  ng_tcpmss_constructor,
  137         .rcvmsg =       ng_tcpmss_rcvmsg,
  138         .newhook =      ng_tcpmss_newhook,
  139         .rcvdata =      ng_tcpmss_rcvdata,
  140         .disconnect =   ng_tcpmss_disconnect,
  141         .cmdlist =      ng_tcpmss_cmds,
  142 };
  143 
  144 NETGRAPH_INIT(tcpmss, &ng_tcpmss_typestruct);
  145 
  146 #define ERROUT(x)       { error = (x); goto done; }
  147 
  148 /*
  149  * Node constructor. No special actions required.
  150  */
  151 static int
  152 ng_tcpmss_constructor(node_p node)
  153 {
  154         return (0);
  155 }
  156 
  157 /*
  158  * Add a hook. Any unique name is OK.
  159  */
  160 static int
  161 ng_tcpmss_newhook(node_p node, hook_p hook, const char *name)
  162 {
  163         hpriv_p priv;
  164 
  165         priv = malloc(sizeof(*priv), M_NETGRAPH, M_NOWAIT | M_ZERO);
  166         if (priv == NULL)
  167                 return (ENOMEM);
  168 
  169         NG_HOOK_SET_PRIVATE(hook, priv);
  170 
  171         return (0);
  172 }
  173 
  174 /*
  175  * Receive a control message.
  176  */
  177 static int
  178 ng_tcpmss_rcvmsg
  179 (node_p node, item_p item, hook_p lasthook)
  180 {
  181         struct ng_mesg *msg, *resp = NULL;
  182         int error = 0;
  183 
  184         NGI_GET_MSG(item, msg);
  185 
  186         switch (msg->header.typecookie) {
  187         case NGM_TCPMSS_COOKIE:
  188                 switch (msg->header.cmd) {
  189                 case NGM_TCPMSS_GET_STATS:
  190                 case NGM_TCPMSS_CLR_STATS:
  191                 case NGM_TCPMSS_GETCLR_STATS:
  192                     {
  193                         hook_p hook;
  194                         hpriv_p priv;
  195 
  196                         /* Check that message is long enough. */
  197                         if (msg->header.arglen != NG_HOOKSIZ)
  198                                 ERROUT(EINVAL);
  199 
  200                         /* Find this hook. */
  201                         hook = ng_findhook(node, (char *)msg->data);
  202                         if (hook == NULL)
  203                                 ERROUT(ENOENT);
  204 
  205                         priv = NG_HOOK_PRIVATE(hook);
  206 
  207                         /* Create response. */
  208                         if (msg->header.cmd != NGM_TCPMSS_CLR_STATS) {
  209                                 NG_MKRESPONSE(resp, msg,
  210                                     sizeof(struct ng_tcpmss_hookstat), M_NOWAIT);
  211                                 if (resp == NULL)
  212                                         ERROUT(ENOMEM);
  213                                 bcopy(&priv->stats, resp->data,
  214                                     sizeof(struct ng_tcpmss_hookstat)); 
  215                         }
  216 
  217                         if (msg->header.cmd != NGM_TCPMSS_GET_STATS)
  218                                 bzero(&priv->stats,
  219                                     sizeof(struct ng_tcpmss_hookstat));
  220                         break;
  221                     }
  222                 case NGM_TCPMSS_CONFIG:
  223                     {
  224                         struct ng_tcpmss_config *set;
  225                         hook_p in, out;
  226                         hpriv_p priv;
  227 
  228                         /* Check that message is long enough. */
  229                         if (msg->header.arglen !=
  230                             sizeof(struct ng_tcpmss_config))
  231                                 ERROUT(EINVAL);
  232 
  233                         set = (struct ng_tcpmss_config *)msg->data;
  234                         in = ng_findhook(node, set->inHook);
  235                         out = ng_findhook(node, set->outHook);
  236                         if (in == NULL || out == NULL)
  237                                 ERROUT(ENOENT);
  238 
  239                         /* Configure MSS hack. */
  240                         priv = NG_HOOK_PRIVATE(in);
  241                         priv->outHook = out;
  242                         priv->stats.maxMSS = set->maxMSS;
  243 
  244                         break;
  245                     }
  246                 default:
  247                         error = EINVAL;
  248                         break;
  249                 }
  250                 break;
  251         default:
  252                 error = EINVAL;
  253                 break;
  254         }
  255 
  256 done:
  257         NG_RESPOND_MSG(error, node, item, resp);
  258         NG_FREE_MSG(msg);
  259 
  260         return (error);
  261 }
  262 
  263 /*
  264  * Receive data on a hook, and hack MSS.
  265  *
  266  */
  267 static int
  268 ng_tcpmss_rcvdata(hook_p hook, item_p item)
  269 {
  270         hpriv_p priv = NG_HOOK_PRIVATE(hook);
  271         struct mbuf *m = NULL;
  272         struct ip *ip;
  273         struct tcphdr *tcp;
  274         int iphlen, tcphlen, pktlen;
  275         int pullup_len = 0;
  276         int error = 0;
  277 
  278         /* Drop packets if filter is not configured on this hook. */
  279         if (priv->outHook == NULL)
  280                 goto done;
  281 
  282         NGI_GET_M(item, m);
  283 
  284         /* Update stats on incoming hook. */
  285         pktlen = m->m_pkthdr.len;
  286         priv->stats.Octets += pktlen;
  287         priv->stats.Packets++;
  288 
  289         /* Check whether we configured to fix MSS. */
  290         if (priv->stats.maxMSS == 0)
  291                 goto send;
  292 
  293 #define M_CHECK(length) do {                                    \
  294         pullup_len += length;                                   \
  295         if ((m)->m_pkthdr.len < pullup_len)                     \
  296                 goto send;                                      \
  297         if ((m)->m_len < pullup_len &&                          \
  298            (((m) = m_pullup((m), pullup_len)) == NULL))         \
  299                 ERROUT(ENOBUFS);                                \
  300         } while (0)
  301 
  302         /* Check mbuf packet size and arrange for IP header. */
  303         M_CHECK(sizeof(struct ip));
  304         ip = mtod(m, struct ip *);
  305 
  306         /* Check IP version. */
  307         if (ip->ip_v != IPVERSION)
  308                 ERROUT(EINVAL);
  309 
  310         /* Check IP header length. */
  311         iphlen = ip->ip_hl << 2;
  312         if (iphlen < sizeof(struct ip) || iphlen > pktlen )
  313                 ERROUT(EINVAL);
  314 
  315         /* Check if it is TCP. */
  316         if (!(ip->ip_p == IPPROTO_TCP))
  317                 goto send;
  318 
  319         /* Check mbuf packet size and arrange for IP+TCP header */
  320         M_CHECK(iphlen - sizeof(struct ip) + sizeof(struct tcphdr));
  321         ip = mtod(m, struct ip *);
  322         tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
  323 
  324         /* Check TCP header length. */
  325         tcphlen = tcp->th_off << 2;
  326         if (tcphlen < sizeof(struct tcphdr) || tcphlen > pktlen - iphlen)
  327                 ERROUT(EINVAL);
  328 
  329         /* Check SYN packet and has options. */
  330         if (!(tcp->th_flags & TH_SYN) || tcphlen == sizeof(struct tcphdr))
  331                 goto send;
  332         
  333         /* Update SYN stats. */
  334         priv->stats.SYNPkts++;
  335 
  336         M_CHECK(tcphlen - sizeof(struct tcphdr));
  337         ip = mtod(m, struct ip *);
  338         tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
  339 
  340 #undef  M_CHECK
  341 
  342         /* Fix MSS and update stats. */
  343         if (correct_mss(tcp, tcphlen, priv->stats.maxMSS,
  344             m->m_pkthdr.csum_flags))
  345                 priv->stats.FixedPkts++;
  346 
  347 send:
  348         /* Deliver frame out destination hook. */
  349         NG_FWD_NEW_DATA(error, item, priv->outHook, m);
  350 
  351         return (error);
  352 
  353 done:
  354         NG_FREE_ITEM(item);
  355         NG_FREE_M(m);
  356 
  357         return (error);
  358 }
  359 
  360 /*
  361  * Hook disconnection.
  362  * We must check all hooks, since they may reference this one.
  363  */
  364 static int
  365 ng_tcpmss_disconnect(hook_p hook)
  366 {
  367         node_p node = NG_HOOK_NODE(hook);
  368         hook_p hook2;
  369 
  370         LIST_FOREACH(hook2, &node->nd_hooks, hk_hooks) {
  371                 hpriv_p priv = NG_HOOK_PRIVATE(hook2);
  372 
  373                 if (priv->outHook == hook)
  374                         priv->outHook = NULL;
  375         }
  376 
  377         free(NG_HOOK_PRIVATE(hook), M_NETGRAPH);
  378 
  379         if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0)
  380                 ng_rmnode_self(NG_HOOK_NODE(hook));
  381 
  382         return (0);
  383 }
  384 
  385 /*
  386  * Code from tcpmssd.
  387  */
  388 
  389 /*-
  390  * The following macro is used to update an
  391  * internet checksum.  "acc" is a 32-bit
  392  * accumulation of all the changes to the
  393  * checksum (adding in old 16-bit words and
  394  * subtracting out new words), and "cksum"
  395  * is the checksum value to be updated.
  396  */
  397 #define TCPMSS_ADJUST_CHECKSUM(acc, cksum) do {         \
  398         acc += cksum;                                   \
  399         if (acc < 0) {                                  \
  400                 acc = -acc;                             \
  401                 acc = (acc >> 16) + (acc & 0xffff);     \
  402                 acc += acc >> 16;                       \
  403                 cksum = (u_short) ~acc;                 \
  404         } else {                                        \
  405                 acc = (acc >> 16) + (acc & 0xffff);     \
  406                 acc += acc >> 16;                       \
  407                 cksum = (u_short) acc;                  \
  408         }                                               \
  409 } while (0);
  410 
  411 static int
  412 correct_mss(struct tcphdr *tc, int hlen, uint16_t maxmss, int flags)
  413 {
  414         int olen, optlen;
  415         u_char *opt;
  416         int accumulate;
  417         int res = 0;
  418         uint16_t sum;
  419 
  420         for (olen = hlen - sizeof(struct tcphdr), opt = (u_char *)(tc + 1);
  421              olen > 0; olen -= optlen, opt += optlen) {
  422                 if (*opt == TCPOPT_EOL)
  423                         break;
  424                 else if (*opt == TCPOPT_NOP)
  425                         optlen = 1;
  426                 else {
  427                         optlen = *(opt + 1);
  428                         if (optlen <= 0 || optlen > olen)
  429                                 break;
  430                         if (*opt == TCPOPT_MAXSEG) {
  431                                 if (optlen != TCPOLEN_MAXSEG)
  432                                         continue;
  433                                 accumulate = be16dec(opt + 2);
  434                                 if (accumulate > maxmss) {
  435                                         if ((flags & CSUM_TCP) == 0) {
  436                                                 accumulate -= maxmss;
  437                                                 sum = be16dec(&tc->th_sum);
  438                                                 TCPMSS_ADJUST_CHECKSUM(accumulate, sum);
  439                                                 be16enc(&tc->th_sum, sum);
  440                                         }
  441                                         be16enc(opt + 2, maxmss);
  442                                         res = 1;
  443                                 }
  444                         }
  445                 }
  446         }
  447         return (res);
  448 }
Cache object: 96762df25735686050e892848be26deb
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netgraph/ng_tcpmss.c

FreeBSD/Linux Kernel Cross Reference
sys/netgraph/ng_tcpmss.c
