1 /*-
2 * ng_tcpmss.c
3 *
4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
5 *
6 * Copyright (c) 2004, Alexey Popov <lollypop@flexuser.ru>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice unmodified, this list of conditions, and the following
14 * disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 * This software includes fragments of the following programs:
32 * tcpmssd Ruslan Ermilov <ru@FreeBSD.org>
33 *
34 * $FreeBSD$
35 */
36
37 /*
38 * This node is netgraph tool for workaround of PMTUD problem. It acts
39 * like filter for IP packets. If configured, it reduces MSS of TCP SYN
40 * packets.
41 *
42 * Configuration can be done by sending NGM_TCPMSS_CONFIG message. The
43 * message sets filter for incoming packets on hook 'inHook'. Packet's
44 * TCP MSS field is lowered to 'maxMSS' parameter and resulting packet
45 * is sent to 'outHook'.
46 *
47 * XXX: statistics are updated not atomically, so they may broke on SMP.
48 */
49
50 #include <sys/param.h>
51 #include <sys/systm.h>
52 #include <sys/endian.h>
53 #include <sys/errno.h>
54 #include <sys/kernel.h>
55 #include <sys/malloc.h>
56 #include <sys/mbuf.h>
57
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/tcp.h>
62
63 #include <netgraph/ng_message.h>
64 #include <netgraph/netgraph.h>
65 #include <netgraph/ng_parse.h>
66 #include <netgraph/ng_tcpmss.h>
67
68 /* Per hook info. */
69 typedef struct {
70 hook_p outHook;
71 struct ng_tcpmss_hookstat stats;
72 } *hpriv_p;
73
74 /* Netgraph methods. */
75 static ng_constructor_t ng_tcpmss_constructor;
76 static ng_rcvmsg_t ng_tcpmss_rcvmsg;
77 static ng_newhook_t ng_tcpmss_newhook;
78 static ng_rcvdata_t ng_tcpmss_rcvdata;
79 static ng_disconnect_t ng_tcpmss_disconnect;
80
81 static int correct_mss(struct tcphdr *, int, uint16_t, int);
82
83 /* Parse type for struct ng_tcpmss_hookstat. */
84 static const struct ng_parse_struct_field ng_tcpmss_hookstat_type_fields[]
85 = NG_TCPMSS_HOOKSTAT_INFO;
86 static const struct ng_parse_type ng_tcpmss_hookstat_type = {
87 &ng_parse_struct_type,
88 &ng_tcpmss_hookstat_type_fields
89 };
90
91 /* Parse type for struct ng_tcpmss_config. */
92 static const struct ng_parse_struct_field ng_tcpmss_config_type_fields[]
93 = NG_TCPMSS_CONFIG_INFO;
94 static const struct ng_parse_type ng_tcpmss_config_type = {
95 &ng_parse_struct_type,
96 ng_tcpmss_config_type_fields
97 };
98
99 /* List of commands and how to convert arguments to/from ASCII. */
100 static const struct ng_cmdlist ng_tcpmss_cmds[] = {
101 {
102 NGM_TCPMSS_COOKIE,
103 NGM_TCPMSS_GET_STATS,
104 "getstats",
105 &ng_parse_hookbuf_type,
106 &ng_tcpmss_hookstat_type
107 },
108 {
109 NGM_TCPMSS_COOKIE,
110 NGM_TCPMSS_CLR_STATS,
111 "clrstats",
112 &ng_parse_hookbuf_type,
113 NULL
114 },
115 {
116 NGM_TCPMSS_COOKIE,
117 NGM_TCPMSS_GETCLR_STATS,
118 "getclrstats",
119 &ng_parse_hookbuf_type,
120 &ng_tcpmss_hookstat_type
121 },
122 {
123 NGM_TCPMSS_COOKIE,
124 NGM_TCPMSS_CONFIG,
125 "config",
126 &ng_tcpmss_config_type,
127 NULL
128 },
129 { 0 }
130 };
131
132 /* Netgraph type descriptor. */
133 static struct ng_type ng_tcpmss_typestruct = {
134 .version = NG_ABI_VERSION,
135 .name = NG_TCPMSS_NODE_TYPE,
136 .constructor = ng_tcpmss_constructor,
137 .rcvmsg = ng_tcpmss_rcvmsg,
138 .newhook = ng_tcpmss_newhook,
139 .rcvdata = ng_tcpmss_rcvdata,
140 .disconnect = ng_tcpmss_disconnect,
141 .cmdlist = ng_tcpmss_cmds,
142 };
143
144 NETGRAPH_INIT(tcpmss, &ng_tcpmss_typestruct);
145
146 #define ERROUT(x) { error = (x); goto done; }
147
148 /*
149 * Node constructor. No special actions required.
150 */
151 static int
152 ng_tcpmss_constructor(node_p node)
153 {
154 return (0);
155 }
156
157 /*
158 * Add a hook. Any unique name is OK.
159 */
160 static int
161 ng_tcpmss_newhook(node_p node, hook_p hook, const char *name)
162 {
163 hpriv_p priv;
164
165 priv = malloc(sizeof(*priv), M_NETGRAPH, M_NOWAIT | M_ZERO);
166 if (priv == NULL)
167 return (ENOMEM);
168
169 NG_HOOK_SET_PRIVATE(hook, priv);
170
171 return (0);
172 }
173
174 /*
175 * Receive a control message.
176 */
177 static int
178 ng_tcpmss_rcvmsg
179 (node_p node, item_p item, hook_p lasthook)
180 {
181 struct ng_mesg *msg, *resp = NULL;
182 int error = 0;
183
184 NGI_GET_MSG(item, msg);
185
186 switch (msg->header.typecookie) {
187 case NGM_TCPMSS_COOKIE:
188 switch (msg->header.cmd) {
189 case NGM_TCPMSS_GET_STATS:
190 case NGM_TCPMSS_CLR_STATS:
191 case NGM_TCPMSS_GETCLR_STATS:
192 {
193 hook_p hook;
194 hpriv_p priv;
195
196 /* Check that message is long enough. */
197 if (msg->header.arglen != NG_HOOKSIZ)
198 ERROUT(EINVAL);
199
200 /* Find this hook. */
201 hook = ng_findhook(node, (char *)msg->data);
202 if (hook == NULL)
203 ERROUT(ENOENT);
204
205 priv = NG_HOOK_PRIVATE(hook);
206
207 /* Create response. */
208 if (msg->header.cmd != NGM_TCPMSS_CLR_STATS) {
209 NG_MKRESPONSE(resp, msg,
210 sizeof(struct ng_tcpmss_hookstat), M_NOWAIT);
211 if (resp == NULL)
212 ERROUT(ENOMEM);
213 bcopy(&priv->stats, resp->data,
214 sizeof(struct ng_tcpmss_hookstat));
215 }
216
217 if (msg->header.cmd != NGM_TCPMSS_GET_STATS)
218 bzero(&priv->stats,
219 sizeof(struct ng_tcpmss_hookstat));
220 break;
221 }
222 case NGM_TCPMSS_CONFIG:
223 {
224 struct ng_tcpmss_config *set;
225 hook_p in, out;
226 hpriv_p priv;
227
228 /* Check that message is long enough. */
229 if (msg->header.arglen !=
230 sizeof(struct ng_tcpmss_config))
231 ERROUT(EINVAL);
232
233 set = (struct ng_tcpmss_config *)msg->data;
234 in = ng_findhook(node, set->inHook);
235 out = ng_findhook(node, set->outHook);
236 if (in == NULL || out == NULL)
237 ERROUT(ENOENT);
238
239 /* Configure MSS hack. */
240 priv = NG_HOOK_PRIVATE(in);
241 priv->outHook = out;
242 priv->stats.maxMSS = set->maxMSS;
243
244 break;
245 }
246 default:
247 error = EINVAL;
248 break;
249 }
250 break;
251 default:
252 error = EINVAL;
253 break;
254 }
255
256 done:
257 NG_RESPOND_MSG(error, node, item, resp);
258 NG_FREE_MSG(msg);
259
260 return (error);
261 }
262
263 /*
264 * Receive data on a hook, and hack MSS.
265 *
266 */
267 static int
268 ng_tcpmss_rcvdata(hook_p hook, item_p item)
269 {
270 hpriv_p priv = NG_HOOK_PRIVATE(hook);
271 struct mbuf *m = NULL;
272 struct ip *ip;
273 struct tcphdr *tcp;
274 int iphlen, tcphlen, pktlen;
275 int pullup_len = 0;
276 int error = 0;
277
278 /* Drop packets if filter is not configured on this hook. */
279 if (priv->outHook == NULL)
280 goto done;
281
282 NGI_GET_M(item, m);
283
284 /* Update stats on incoming hook. */
285 pktlen = m->m_pkthdr.len;
286 priv->stats.Octets += pktlen;
287 priv->stats.Packets++;
288
289 /* Check whether we configured to fix MSS. */
290 if (priv->stats.maxMSS == 0)
291 goto send;
292
293 #define M_CHECK(length) do { \
294 pullup_len += length; \
295 if ((m)->m_pkthdr.len < pullup_len) \
296 goto send; \
297 if ((m)->m_len < pullup_len && \
298 (((m) = m_pullup((m), pullup_len)) == NULL)) \
299 ERROUT(ENOBUFS); \
300 } while (0)
301
302 /* Check mbuf packet size and arrange for IP header. */
303 M_CHECK(sizeof(struct ip));
304 ip = mtod(m, struct ip *);
305
306 /* Check IP version. */
307 if (ip->ip_v != IPVERSION)
308 ERROUT(EINVAL);
309
310 /* Check IP header length. */
311 iphlen = ip->ip_hl << 2;
312 if (iphlen < sizeof(struct ip) || iphlen > pktlen )
313 ERROUT(EINVAL);
314
315 /* Check if it is TCP. */
316 if (!(ip->ip_p == IPPROTO_TCP))
317 goto send;
318
319 /* Check mbuf packet size and arrange for IP+TCP header */
320 M_CHECK(iphlen - sizeof(struct ip) + sizeof(struct tcphdr));
321 ip = mtod(m, struct ip *);
322 tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
323
324 /* Check TCP header length. */
325 tcphlen = tcp->th_off << 2;
326 if (tcphlen < sizeof(struct tcphdr) || tcphlen > pktlen - iphlen)
327 ERROUT(EINVAL);
328
329 /* Check SYN packet and has options. */
330 if (!(tcp->th_flags & TH_SYN) || tcphlen == sizeof(struct tcphdr))
331 goto send;
332
333 /* Update SYN stats. */
334 priv->stats.SYNPkts++;
335
336 M_CHECK(tcphlen - sizeof(struct tcphdr));
337 ip = mtod(m, struct ip *);
338 tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
339
340 #undef M_CHECK
341
342 /* Fix MSS and update stats. */
343 if (correct_mss(tcp, tcphlen, priv->stats.maxMSS,
344 m->m_pkthdr.csum_flags))
345 priv->stats.FixedPkts++;
346
347 send:
348 /* Deliver frame out destination hook. */
349 NG_FWD_NEW_DATA(error, item, priv->outHook, m);
350
351 return (error);
352
353 done:
354 NG_FREE_ITEM(item);
355 NG_FREE_M(m);
356
357 return (error);
358 }
359
360 /*
361 * Hook disconnection.
362 * We must check all hooks, since they may reference this one.
363 */
364 static int
365 ng_tcpmss_disconnect(hook_p hook)
366 {
367 node_p node = NG_HOOK_NODE(hook);
368 hook_p hook2;
369
370 LIST_FOREACH(hook2, &node->nd_hooks, hk_hooks) {
371 hpriv_p priv = NG_HOOK_PRIVATE(hook2);
372
373 if (priv->outHook == hook)
374 priv->outHook = NULL;
375 }
376
377 free(NG_HOOK_PRIVATE(hook), M_NETGRAPH);
378
379 if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0)
380 ng_rmnode_self(NG_HOOK_NODE(hook));
381
382 return (0);
383 }
384
385 /*
386 * Code from tcpmssd.
387 */
388
389 /*-
390 * The following macro is used to update an
391 * internet checksum. "acc" is a 32-bit
392 * accumulation of all the changes to the
393 * checksum (adding in old 16-bit words and
394 * subtracting out new words), and "cksum"
395 * is the checksum value to be updated.
396 */
397 #define TCPMSS_ADJUST_CHECKSUM(acc, cksum) do { \
398 acc += cksum; \
399 if (acc < 0) { \
400 acc = -acc; \
401 acc = (acc >> 16) + (acc & 0xffff); \
402 acc += acc >> 16; \
403 cksum = (u_short) ~acc; \
404 } else { \
405 acc = (acc >> 16) + (acc & 0xffff); \
406 acc += acc >> 16; \
407 cksum = (u_short) acc; \
408 } \
409 } while (0);
410
411 static int
412 correct_mss(struct tcphdr *tc, int hlen, uint16_t maxmss, int flags)
413 {
414 int olen, optlen;
415 u_char *opt;
416 int accumulate;
417 int res = 0;
418 uint16_t sum;
419
420 for (olen = hlen - sizeof(struct tcphdr), opt = (u_char *)(tc + 1);
421 olen > 0; olen -= optlen, opt += optlen) {
422 if (*opt == TCPOPT_EOL)
423 break;
424 else if (*opt == TCPOPT_NOP)
425 optlen = 1;
426 else {
427 optlen = *(opt + 1);
428 if (optlen <= 0 || optlen > olen)
429 break;
430 if (*opt == TCPOPT_MAXSEG) {
431 if (optlen != TCPOLEN_MAXSEG)
432 continue;
433 accumulate = be16dec(opt + 2);
434 if (accumulate > maxmss) {
435 if ((flags & CSUM_TCP) == 0) {
436 accumulate -= maxmss;
437 sum = be16dec(&tc->th_sum);
438 TCPMSS_ADJUST_CHECKSUM(accumulate, sum);
439 be16enc(&tc->th_sum, sum);
440 }
441 be16enc(opt + 2, maxmss);
442 res = 1;
443 }
444 }
445 }
446 }
447 return (res);
448 }
Cache object: db76d3e92f018c333c0d0befac667c2b
|