4 * Copyright (c) 2004, Alexey Popov <lollypop@flexuser.ru>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice unmodified, this list of conditions, and the following
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * This software includes fragments of the following programs:
30 * tcpmssd Ruslan Ermilov <ru@FreeBSD.org>
32 * $FreeBSD: src/sys/netgraph/ng_tcpmss.c,v 1.4 2007/01/15 05:01:31 glebius Exp $
36 * This node is netgraph tool for workaround of PMTUD problem. It acts
37 * like filter for IP packets. If configured, it reduces MSS of TCP SYN
40 * Configuration can be done by sending NGM_TCPMSS_CONFIG message. The
41 * message sets filter for incoming packets on hook 'inHook'. Packet's
42 * TCP MSS field is lowered to 'maxMSS' parameter and resulting packet
43 * is sent to 'outHook'.
45 * XXX: statistics are updated not atomically, so they may broke on SMP.
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/errno.h>
51 #include <sys/kernel.h>
52 #include <sys/malloc.h>
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/ip.h>
58 #include <netinet/tcp.h>
60 #include <netgraph/ng_message.h>
61 #include <netgraph/netgraph.h>
62 #include <netgraph/ng_parse.h>
63 #include <netgraph/ng_tcpmss.h>
68 struct ng_tcpmss_hookstat stats
;
71 /* Netgraph methods. */
72 static ng_constructor_t ng_tcpmss_constructor
;
73 static ng_rcvmsg_t ng_tcpmss_rcvmsg
;
74 static ng_newhook_t ng_tcpmss_newhook
;
75 static ng_rcvdata_t ng_tcpmss_rcvdata
;
76 static ng_disconnect_t ng_tcpmss_disconnect
;
78 static int correct_mss(struct tcphdr
*, int, uint16_t, int);
80 /* Parse type for struct ng_tcpmss_hookstat. */
81 static const struct ng_parse_struct_field ng_tcpmss_hookstat_type_fields
[]
82 = NG_TCPMSS_HOOKSTAT_INFO
;
83 static const struct ng_parse_type ng_tcpmss_hookstat_type
= {
84 &ng_parse_struct_type
,
85 &ng_tcpmss_hookstat_type_fields
88 /* Parse type for struct ng_tcpmss_config. */
89 static const struct ng_parse_struct_field ng_tcpmss_config_type_fields
[]
90 = NG_TCPMSS_CONFIG_INFO
;
91 static const struct ng_parse_type ng_tcpmss_config_type
= {
92 &ng_parse_struct_type
,
93 ng_tcpmss_config_type_fields
96 /* List of commands and how to convert arguments to/from ASCII. */
97 static const struct ng_cmdlist ng_tcpmss_cmds
[] = {
100 NGM_TCPMSS_GET_STATS
,
102 &ng_parse_hookbuf_type
,
103 &ng_tcpmss_hookstat_type
107 NGM_TCPMSS_CLR_STATS
,
109 &ng_parse_hookbuf_type
,
114 NGM_TCPMSS_GETCLR_STATS
,
116 &ng_parse_hookbuf_type
,
117 &ng_tcpmss_hookstat_type
123 &ng_tcpmss_config_type
,
129 /* Netgraph type descriptor. */
130 static struct ng_type ng_tcpmss_typestruct
= {
131 .version
= NG_ABI_VERSION
,
132 .name
= NG_TCPMSS_NODE_TYPE
,
133 .constructor
= ng_tcpmss_constructor
,
134 .rcvmsg
= ng_tcpmss_rcvmsg
,
135 .newhook
= ng_tcpmss_newhook
,
136 .rcvdata
= ng_tcpmss_rcvdata
,
137 .disconnect
= ng_tcpmss_disconnect
,
138 .cmdlist
= ng_tcpmss_cmds
,
141 NETGRAPH_INIT(tcpmss
, &ng_tcpmss_typestruct
);
143 #define ERROUT(x) { error = (x); goto done; }
146 * Node constructor. No special actions required.
149 ng_tcpmss_constructor(node_p node
)
155 * Add a hook. Any unique name is OK.
158 ng_tcpmss_newhook(node_p node
, hook_p hook
, const char *name
)
162 MALLOC(priv
, hpriv_p
, sizeof(*priv
), M_NETGRAPH
, M_NOWAIT
| M_ZERO
);
166 NG_HOOK_SET_PRIVATE(hook
, priv
);
172 * Receive a control message.
176 (node_p node
, item_p item
, hook_p lasthook
)
178 struct ng_mesg
*msg
, *resp
= NULL
;
181 NGI_GET_MSG(item
, msg
);
183 switch (msg
->header
.typecookie
) {
184 case NGM_TCPMSS_COOKIE
:
185 switch (msg
->header
.cmd
) {
186 case NGM_TCPMSS_GET_STATS
:
187 case NGM_TCPMSS_CLR_STATS
:
188 case NGM_TCPMSS_GETCLR_STATS
:
193 /* Check that message is long enough. */
194 if (msg
->header
.arglen
!= NG_HOOKSIZ
)
197 /* Find this hook. */
198 hook
= ng_findhook(node
, (char *)msg
->data
);
202 priv
= NG_HOOK_PRIVATE(hook
);
204 /* Create response. */
205 if (msg
->header
.cmd
!= NGM_TCPMSS_CLR_STATS
) {
206 NG_MKRESPONSE(resp
, msg
,
207 sizeof(struct ng_tcpmss_hookstat
), M_NOWAIT
);
210 bcopy(&priv
->stats
, resp
->data
,
211 sizeof(struct ng_tcpmss_hookstat
));
214 if (msg
->header
.cmd
!= NGM_TCPMSS_GET_STATS
)
216 sizeof(struct ng_tcpmss_hookstat
));
219 case NGM_TCPMSS_CONFIG
:
221 struct ng_tcpmss_config
*set
;
225 /* Check that message is long enough. */
226 if (msg
->header
.arglen
!=
227 sizeof(struct ng_tcpmss_config
))
230 set
= (struct ng_tcpmss_config
*)msg
->data
;
231 in
= ng_findhook(node
, set
->inHook
);
232 out
= ng_findhook(node
, set
->outHook
);
233 if (in
== NULL
|| out
== NULL
)
236 /* Configure MSS hack. */
237 priv
= NG_HOOK_PRIVATE(in
);
239 priv
->stats
.maxMSS
= set
->maxMSS
;
254 NG_RESPOND_MSG(error
, node
, item
, resp
);
261 * Receive data on a hook, and hack MSS.
265 ng_tcpmss_rcvdata(hook_p hook
, item_p item
)
267 hpriv_p priv
= NG_HOOK_PRIVATE(hook
);
268 struct mbuf
*m
= NULL
;
271 int iphlen
, tcphlen
, pktlen
;
275 /* Drop packets if filter is not configured on this hook. */
276 if (priv
->outHook
== NULL
)
281 /* Update stats on incoming hook. */
282 pktlen
= m
->m_pkthdr
.len
;
283 priv
->stats
.Octets
+= pktlen
;
284 priv
->stats
.Packets
++;
286 /* Check whether we configured to fix MSS. */
287 if (priv
->stats
.maxMSS
== 0)
290 #define M_CHECK(length) do { \
291 pullup_len += length; \
292 if ((m)->m_pkthdr.len < pullup_len) \
294 if ((m)->m_len < pullup_len && \
295 (((m) = m_pullup((m), pullup_len)) == NULL)) \
299 /* Check mbuf packet size and arrange for IP header. */
300 M_CHECK(sizeof(struct ip
));
301 ip
= mtod(m
, struct ip
*);
303 /* Check IP version. */
304 if (ip
->ip_v
!= IPVERSION
)
307 /* Check IP header length. */
308 iphlen
= ip
->ip_hl
<< 2;
309 if (iphlen
< sizeof(struct ip
) || iphlen
> pktlen
)
312 /* Check if it is TCP. */
313 if (!(ip
->ip_p
== IPPROTO_TCP
))
316 /* Check mbuf packet size and arrange for IP+TCP header */
317 M_CHECK(iphlen
- sizeof(struct ip
) + sizeof(struct tcphdr
));
318 ip
= mtod(m
, struct ip
*);
319 tcp
= (struct tcphdr
*)((caddr_t
)ip
+ iphlen
);
321 /* Check TCP header length. */
322 tcphlen
= tcp
->th_off
<< 2;
323 if (tcphlen
< sizeof(struct tcphdr
) || tcphlen
> pktlen
- iphlen
)
326 /* Check SYN packet and has options. */
327 if (!(tcp
->th_flags
& TH_SYN
) || tcphlen
== sizeof(struct tcphdr
))
330 /* Update SYN stats. */
331 priv
->stats
.SYNPkts
++;
333 M_CHECK(tcphlen
- sizeof(struct tcphdr
));
334 ip
= mtod(m
, struct ip
*);
335 tcp
= (struct tcphdr
*)((caddr_t
)ip
+ iphlen
);
339 /* Fix MSS and update stats. */
340 if (correct_mss(tcp
, tcphlen
, priv
->stats
.maxMSS
,
341 m
->m_pkthdr
.csum_flags
))
342 priv
->stats
.FixedPkts
++;
345 /* Deliver frame out destination hook. */
346 NG_FWD_NEW_DATA(error
, item
, priv
->outHook
, m
);
358 * Hook disconnection.
359 * We must check all hooks, since they may reference this one.
362 ng_tcpmss_disconnect(hook_p hook
)
364 node_p node
= NG_HOOK_NODE(hook
);
367 LIST_FOREACH(hook2
, &node
->nd_hooks
, hk_hooks
) {
368 hpriv_p priv
= NG_HOOK_PRIVATE(hook2
);
370 if (priv
->outHook
== hook
)
371 priv
->outHook
= NULL
;
374 FREE(NG_HOOK_PRIVATE(hook
), M_NETGRAPH
);
376 if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook
)) == 0)
377 ng_rmnode_self(NG_HOOK_NODE(hook
));
387 * The following macro is used to update an
388 * internet checksum. "acc" is a 32-bit
389 * accumulation of all the changes to the
390 * checksum (adding in old 16-bit words and
391 * subtracting out new words), and "cksum"
392 * is the checksum value to be updated.
394 #define TCPMSS_ADJUST_CHECKSUM(acc, cksum) do { \
398 acc = (acc >> 16) + (acc & 0xffff); \
400 cksum = (u_short) ~acc; \
402 acc = (acc >> 16) + (acc & 0xffff); \
404 cksum = (u_short) acc; \
409 correct_mss(struct tcphdr
*tc
, int hlen
, uint16_t maxmss
, int flags
)
417 for (olen
= hlen
- sizeof(struct tcphdr
), opt
= (u_char
*)(tc
+ 1);
418 olen
> 0; olen
-= optlen
, opt
+= optlen
) {
419 if (*opt
== TCPOPT_EOL
)
421 else if (*opt
== TCPOPT_NOP
)
425 if (optlen
<= 0 || optlen
> olen
)
427 if (*opt
== TCPOPT_MAXSEG
) {
428 if (optlen
!= TCPOLEN_MAXSEG
)
430 mss
= (uint16_t *)(opt
+ 2);
431 if (ntohs(*mss
) > maxmss
) {
433 *mss
= htons(maxmss
);
435 if ((flags
& CSUM_TCP
) == 0)
436 TCPMSS_ADJUST_CHECKSUM(accumulate
, tc
->th_sum
);