1 /*- 2 * ng_tcpmss.c 3 * 4 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5 * 6 * Copyright (c) 2004, Alexey Popov <lollypop@flexuser.ru> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice unmodified, this list of conditions, and the following 14 * disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * This software includes fragments of the following programs: 32 * tcpmssd Ruslan Ermilov <ru@FreeBSD.org> 33 * 34 * $FreeBSD$ 35 */ 36 37 /* 38 * This node is netgraph tool for workaround of PMTUD problem. It acts 39 * like filter for IP packets. If configured, it reduces MSS of TCP SYN 40 * packets. 41 * 42 * Configuration can be done by sending NGM_TCPMSS_CONFIG message. The 43 * message sets filter for incoming packets on hook 'inHook'. Packet's 44 * TCP MSS field is lowered to 'maxMSS' parameter and resulting packet 45 * is sent to 'outHook'. 46 * 47 * XXX: statistics are updated not atomically, so they may broke on SMP. 48 */ 49 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/endian.h> 53 #include <sys/errno.h> 54 #include <sys/kernel.h> 55 #include <sys/malloc.h> 56 #include <sys/mbuf.h> 57 58 #include <netinet/in.h> 59 #include <netinet/in_systm.h> 60 #include <netinet/ip.h> 61 #include <netinet/tcp.h> 62 63 #include <netgraph/ng_message.h> 64 #include <netgraph/netgraph.h> 65 #include <netgraph/ng_parse.h> 66 #include <netgraph/ng_tcpmss.h> 67 68 /* Per hook info. */ 69 typedef struct { 70 hook_p outHook; 71 struct ng_tcpmss_hookstat stats; 72 } *hpriv_p; 73 74 /* Netgraph methods. */ 75 static ng_constructor_t ng_tcpmss_constructor; 76 static ng_rcvmsg_t ng_tcpmss_rcvmsg; 77 static ng_newhook_t ng_tcpmss_newhook; 78 static ng_rcvdata_t ng_tcpmss_rcvdata; 79 static ng_disconnect_t ng_tcpmss_disconnect; 80 81 static int correct_mss(struct tcphdr *, int, uint16_t, int); 82 83 /* Parse type for struct ng_tcpmss_hookstat. */ 84 static const struct ng_parse_struct_field ng_tcpmss_hookstat_type_fields[] 85 = NG_TCPMSS_HOOKSTAT_INFO; 86 static const struct ng_parse_type ng_tcpmss_hookstat_type = { 87 &ng_parse_struct_type, 88 &ng_tcpmss_hookstat_type_fields 89 }; 90 91 /* Parse type for struct ng_tcpmss_config. */ 92 static const struct ng_parse_struct_field ng_tcpmss_config_type_fields[] 93 = NG_TCPMSS_CONFIG_INFO; 94 static const struct ng_parse_type ng_tcpmss_config_type = { 95 &ng_parse_struct_type, 96 ng_tcpmss_config_type_fields 97 }; 98 99 /* List of commands and how to convert arguments to/from ASCII. */ 100 static const struct ng_cmdlist ng_tcpmss_cmds[] = { 101 { 102 NGM_TCPMSS_COOKIE, 103 NGM_TCPMSS_GET_STATS, 104 "getstats", 105 &ng_parse_hookbuf_type, 106 &ng_tcpmss_hookstat_type 107 }, 108 { 109 NGM_TCPMSS_COOKIE, 110 NGM_TCPMSS_CLR_STATS, 111 "clrstats", 112 &ng_parse_hookbuf_type, 113 NULL 114 }, 115 { 116 NGM_TCPMSS_COOKIE, 117 NGM_TCPMSS_GETCLR_STATS, 118 "getclrstats", 119 &ng_parse_hookbuf_type, 120 &ng_tcpmss_hookstat_type 121 }, 122 { 123 NGM_TCPMSS_COOKIE, 124 NGM_TCPMSS_CONFIG, 125 "config", 126 &ng_tcpmss_config_type, 127 NULL 128 }, 129 { 0 } 130 }; 131 132 /* Netgraph type descriptor. */ 133 static struct ng_type ng_tcpmss_typestruct = { 134 .version = NG_ABI_VERSION, 135 .name = NG_TCPMSS_NODE_TYPE, 136 .constructor = ng_tcpmss_constructor, 137 .rcvmsg = ng_tcpmss_rcvmsg, 138 .newhook = ng_tcpmss_newhook, 139 .rcvdata = ng_tcpmss_rcvdata, 140 .disconnect = ng_tcpmss_disconnect, 141 .cmdlist = ng_tcpmss_cmds, 142 }; 143 144 NETGRAPH_INIT(tcpmss, &ng_tcpmss_typestruct); 145 146 #define ERROUT(x) { error = (x); goto done; } 147 148 /* 149 * Node constructor. No special actions required. 150 */ 151 static int 152 ng_tcpmss_constructor(node_p node) 153 { 154 return (0); 155 } 156 157 /* 158 * Add a hook. Any unique name is OK. 159 */ 160 static int 161 ng_tcpmss_newhook(node_p node, hook_p hook, const char *name) 162 { 163 hpriv_p priv; 164 165 priv = malloc(sizeof(*priv), M_NETGRAPH, M_NOWAIT | M_ZERO); 166 if (priv == NULL) 167 return (ENOMEM); 168 169 NG_HOOK_SET_PRIVATE(hook, priv); 170 171 return (0); 172 } 173 174 /* 175 * Receive a control message. 176 */ 177 static int 178 ng_tcpmss_rcvmsg 179 (node_p node, item_p item, hook_p lasthook) 180 { 181 struct ng_mesg *msg, *resp = NULL; 182 int error = 0; 183 184 NGI_GET_MSG(item, msg); 185 186 switch (msg->header.typecookie) { 187 case NGM_TCPMSS_COOKIE: 188 switch (msg->header.cmd) { 189 case NGM_TCPMSS_GET_STATS: 190 case NGM_TCPMSS_CLR_STATS: 191 case NGM_TCPMSS_GETCLR_STATS: 192 { 193 hook_p hook; 194 hpriv_p priv; 195 196 /* Check that message is long enough. */ 197 if (msg->header.arglen != NG_HOOKSIZ) 198 ERROUT(EINVAL); 199 200 /* Find this hook. */ 201 hook = ng_findhook(node, (char *)msg->data); 202 if (hook == NULL) 203 ERROUT(ENOENT); 204 205 priv = NG_HOOK_PRIVATE(hook); 206 207 /* Create response. */ 208 if (msg->header.cmd != NGM_TCPMSS_CLR_STATS) { 209 NG_MKRESPONSE(resp, msg, 210 sizeof(struct ng_tcpmss_hookstat), M_NOWAIT); 211 if (resp == NULL) 212 ERROUT(ENOMEM); 213 bcopy(&priv->stats, resp->data, 214 sizeof(struct ng_tcpmss_hookstat)); 215 } 216 217 if (msg->header.cmd != NGM_TCPMSS_GET_STATS) 218 bzero(&priv->stats, 219 sizeof(struct ng_tcpmss_hookstat)); 220 break; 221 } 222 case NGM_TCPMSS_CONFIG: 223 { 224 struct ng_tcpmss_config *set; 225 hook_p in, out; 226 hpriv_p priv; 227 228 /* Check that message is long enough. */ 229 if (msg->header.arglen != 230 sizeof(struct ng_tcpmss_config)) 231 ERROUT(EINVAL); 232 233 set = (struct ng_tcpmss_config *)msg->data; 234 in = ng_findhook(node, set->inHook); 235 out = ng_findhook(node, set->outHook); 236 if (in == NULL || out == NULL) 237 ERROUT(ENOENT); 238 239 /* Configure MSS hack. */ 240 priv = NG_HOOK_PRIVATE(in); 241 priv->outHook = out; 242 priv->stats.maxMSS = set->maxMSS; 243 244 break; 245 } 246 default: 247 error = EINVAL; 248 break; 249 } 250 break; 251 default: 252 error = EINVAL; 253 break; 254 } 255 256 done: 257 NG_RESPOND_MSG(error, node, item, resp); 258 NG_FREE_MSG(msg); 259 260 return (error); 261 } 262 263 /* 264 * Receive data on a hook, and hack MSS. 265 * 266 */ 267 static int 268 ng_tcpmss_rcvdata(hook_p hook, item_p item) 269 { 270 hpriv_p priv = NG_HOOK_PRIVATE(hook); 271 struct mbuf *m = NULL; 272 struct ip *ip; 273 struct tcphdr *tcp; 274 int iphlen, tcphlen, pktlen; 275 int pullup_len = 0; 276 int error = 0; 277 278 /* Drop packets if filter is not configured on this hook. */ 279 if (priv->outHook == NULL) 280 goto done; 281 282 NGI_GET_M(item, m); 283 284 /* Update stats on incoming hook. */ 285 pktlen = m->m_pkthdr.len; 286 priv->stats.Octets += pktlen; 287 priv->stats.Packets++; 288 289 /* Check whether we configured to fix MSS. */ 290 if (priv->stats.maxMSS == 0) 291 goto send; 292 293 #define M_CHECK(length) do { \ 294 pullup_len += length; \ 295 if ((m)->m_pkthdr.len < pullup_len) \ 296 goto send; \ 297 if ((m)->m_len < pullup_len && \ 298 (((m) = m_pullup((m), pullup_len)) == NULL)) \ 299 ERROUT(ENOBUFS); \ 300 } while (0) 301 302 /* Check mbuf packet size and arrange for IP header. */ 303 M_CHECK(sizeof(struct ip)); 304 ip = mtod(m, struct ip *); 305 306 /* Check IP version. */ 307 if (ip->ip_v != IPVERSION) 308 ERROUT(EINVAL); 309 310 /* Check IP header length. */ 311 iphlen = ip->ip_hl << 2; 312 if (iphlen < sizeof(struct ip) || iphlen > pktlen ) 313 ERROUT(EINVAL); 314 315 /* Check if it is TCP. */ 316 if (!(ip->ip_p == IPPROTO_TCP)) 317 goto send; 318 319 /* Check mbuf packet size and arrange for IP+TCP header */ 320 M_CHECK(iphlen - sizeof(struct ip) + sizeof(struct tcphdr)); 321 ip = mtod(m, struct ip *); 322 tcp = (struct tcphdr *)((caddr_t )ip + iphlen); 323 324 /* Check TCP header length. */ 325 tcphlen = tcp->th_off << 2; 326 if (tcphlen < sizeof(struct tcphdr) || tcphlen > pktlen - iphlen) 327 ERROUT(EINVAL); 328 329 /* Check SYN packet and has options. */ 330 if (!(tcp->th_flags & TH_SYN) || tcphlen == sizeof(struct tcphdr)) 331 goto send; 332 333 /* Update SYN stats. */ 334 priv->stats.SYNPkts++; 335 336 M_CHECK(tcphlen - sizeof(struct tcphdr)); 337 ip = mtod(m, struct ip *); 338 tcp = (struct tcphdr *)((caddr_t )ip + iphlen); 339 340 #undef M_CHECK 341 342 /* Fix MSS and update stats. */ 343 if (correct_mss(tcp, tcphlen, priv->stats.maxMSS, 344 m->m_pkthdr.csum_flags)) 345 priv->stats.FixedPkts++; 346 347 send: 348 /* Deliver frame out destination hook. */ 349 NG_FWD_NEW_DATA(error, item, priv->outHook, m); 350 351 return (error); 352 353 done: 354 NG_FREE_ITEM(item); 355 NG_FREE_M(m); 356 357 return (error); 358 } 359 360 /* 361 * Hook disconnection. 362 * We must check all hooks, since they may reference this one. 363 */ 364 static int 365 ng_tcpmss_disconnect(hook_p hook) 366 { 367 node_p node = NG_HOOK_NODE(hook); 368 hook_p hook2; 369 370 LIST_FOREACH(hook2, &node->nd_hooks, hk_hooks) { 371 hpriv_p priv = NG_HOOK_PRIVATE(hook2); 372 373 if (priv->outHook == hook) 374 priv->outHook = NULL; 375 } 376 377 free(NG_HOOK_PRIVATE(hook), M_NETGRAPH); 378 379 if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0) 380 ng_rmnode_self(NG_HOOK_NODE(hook)); 381 382 return (0); 383 } 384 385 /* 386 * Code from tcpmssd. 387 */ 388 389 /*- 390 * The following macro is used to update an 391 * internet checksum. "acc" is a 32-bit 392 * accumulation of all the changes to the 393 * checksum (adding in old 16-bit words and 394 * subtracting out new words), and "cksum" 395 * is the checksum value to be updated. 396 */ 397 #define TCPMSS_ADJUST_CHECKSUM(acc, cksum) do { \ 398 acc += cksum; \ 399 if (acc < 0) { \ 400 acc = -acc; \ 401 acc = (acc >> 16) + (acc & 0xffff); \ 402 acc += acc >> 16; \ 403 cksum = (u_short) ~acc; \ 404 } else { \ 405 acc = (acc >> 16) + (acc & 0xffff); \ 406 acc += acc >> 16; \ 407 cksum = (u_short) acc; \ 408 } \ 409 } while (0); 410 411 static int 412 correct_mss(struct tcphdr *tc, int hlen, uint16_t maxmss, int flags) 413 { 414 int olen, optlen; 415 u_char *opt; 416 int accumulate; 417 int res = 0; 418 uint16_t sum; 419 420 for (olen = hlen - sizeof(struct tcphdr), opt = (u_char *)(tc + 1); 421 olen > 0; olen -= optlen, opt += optlen) { 422 if (*opt == TCPOPT_EOL) 423 break; 424 else if (*opt == TCPOPT_NOP) 425 optlen = 1; 426 else { 427 optlen = *(opt + 1); 428 if (optlen <= 0 || optlen > olen) 429 break; 430 if (*opt == TCPOPT_MAXSEG) { 431 if (optlen != TCPOLEN_MAXSEG) 432 continue; 433 accumulate = be16dec(opt + 2); 434 if (accumulate > maxmss) { 435 if ((flags & CSUM_TCP) == 0) { 436 accumulate -= maxmss; 437 sum = be16dec(&tc->th_sum); 438 TCPMSS_ADJUST_CHECKSUM(accumulate, sum); 439 be16enc(&tc->th_sum, sum); 440 } 441 be16enc(opt + 2, maxmss); 442 res = 1; 443 } 444 } 445 } 446 } 447 return (res); 448 } 449