fa098d025bf5872d51d12818e00f8f67ddac6e24
[dragonfly.git] / sys / netgraph7 / ng_tcpmss.c
1 /*-
2  * ng_tcpmss.c
3  *
4  * Copyright (c) 2004, Alexey Popov <lollypop@flexuser.ru>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice unmodified, this list of conditions, and the following
12  *    disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  * This software includes fragments of the following programs:
30  *      tcpmssd         Ruslan Ermilov <ru@FreeBSD.org>
31  *
32  * $FreeBSD: src/sys/netgraph/ng_tcpmss.c,v 1.4 2007/01/15 05:01:31 glebius Exp $
33  * $DragonFly: src/sys/netgraph7/ng_tcpmss.c,v 1.2 2008/06/26 23:05:35 dillon Exp $
34  */
35
36 /*
37  * This node is netgraph tool for workaround of PMTUD problem. It acts
38  * like filter for IP packets. If configured, it reduces MSS of TCP SYN
39  * packets.
40  *
41  * Configuration can be done by sending NGM_TCPMSS_CONFIG message. The
42  * message sets filter for incoming packets on hook 'inHook'. Packet's
43  * TCP MSS field is lowered to 'maxMSS' parameter and resulting packet
44  * is sent to 'outHook'.
45  *
46  * XXX: statistics are updated not atomically, so they may broke on SMP.
47  */
48
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/errno.h>
52 #include <sys/kernel.h>
53 #include <sys/malloc.h>
54 #include <sys/mbuf.h>
55
56 #include <netinet/in.h>
57 #include <netinet/in_systm.h>
58 #include <netinet/ip.h>
59 #include <netinet/tcp.h>
60
61 #include "ng_message.h"
62 #include "netgraph.h"
63 #include "ng_parse.h"
64 #include "ng_tcpmss.h"
65
66 /* Per hook info. */
67 typedef struct {
68         hook_p                          outHook;
69         struct ng_tcpmss_hookstat       stats;
70 } *hpriv_p;
71
72 /* Netgraph methods. */
73 static ng_constructor_t ng_tcpmss_constructor;
74 static ng_rcvmsg_t      ng_tcpmss_rcvmsg;
75 static ng_newhook_t     ng_tcpmss_newhook;
76 static ng_rcvdata_t     ng_tcpmss_rcvdata;
77 static ng_disconnect_t  ng_tcpmss_disconnect;
78
79 static int correct_mss(struct tcphdr *, int, uint16_t, int);
80
81 /* Parse type for struct ng_tcpmss_hookstat. */
82 static const struct ng_parse_struct_field ng_tcpmss_hookstat_type_fields[]
83         = NG_TCPMSS_HOOKSTAT_INFO;
84 static const struct ng_parse_type ng_tcpmss_hookstat_type = {
85         &ng_parse_struct_type,
86         &ng_tcpmss_hookstat_type_fields
87 };
88
89 /* Parse type for struct ng_tcpmss_config. */
90 static const struct ng_parse_struct_field ng_tcpmss_config_type_fields[]
91         = NG_TCPMSS_CONFIG_INFO;
92 static const struct ng_parse_type ng_tcpmss_config_type = {
93         &ng_parse_struct_type,
94         ng_tcpmss_config_type_fields
95 };
96
97 /* List of commands and how to convert arguments to/from ASCII. */
98 static const struct ng_cmdlist ng_tcpmss_cmds[] = {
99         {
100           NGM_TCPMSS_COOKIE,
101           NGM_TCPMSS_GET_STATS,
102           "getstats",
103           &ng_parse_hookbuf_type,
104           &ng_tcpmss_hookstat_type
105         },
106         {
107           NGM_TCPMSS_COOKIE,
108           NGM_TCPMSS_CLR_STATS,
109           "clrstats",
110           &ng_parse_hookbuf_type,
111           NULL
112         },
113         {
114           NGM_TCPMSS_COOKIE,
115           NGM_TCPMSS_GETCLR_STATS,
116           "getclrstats",
117           &ng_parse_hookbuf_type,
118           &ng_tcpmss_hookstat_type
119         },
120         {
121           NGM_TCPMSS_COOKIE,
122           NGM_TCPMSS_CONFIG,
123           "config",
124           &ng_tcpmss_config_type,
125           NULL
126         },
127         { 0 }
128 };
129
130 /* Netgraph type descriptor. */
131 static struct ng_type ng_tcpmss_typestruct = {
132         .version =      NG_ABI_VERSION,
133         .name =         NG_TCPMSS_NODE_TYPE,
134         .constructor =  ng_tcpmss_constructor,
135         .rcvmsg =       ng_tcpmss_rcvmsg,
136         .newhook =      ng_tcpmss_newhook,
137         .rcvdata =      ng_tcpmss_rcvdata,
138         .disconnect =   ng_tcpmss_disconnect,
139         .cmdlist =      ng_tcpmss_cmds,
140 };
141
142 NETGRAPH_INIT(tcpmss, &ng_tcpmss_typestruct);
143
144 #define ERROUT(x)       { error = (x); goto done; }
145
146 /*
147  * Node constructor. No special actions required.
148  */
149 static int
150 ng_tcpmss_constructor(node_p node)
151 {
152         return (0);
153 }
154
155 /*
156  * Add a hook. Any unique name is OK.
157  */
158 static int
159 ng_tcpmss_newhook(node_p node, hook_p hook, const char *name)
160 {
161         hpriv_p priv;
162
163         MALLOC(priv, hpriv_p, sizeof(*priv), M_NETGRAPH, M_WAITOK | M_NULLOK | M_ZERO);
164         if (priv == NULL)
165                 return (ENOMEM);
166
167         NG_HOOK_SET_PRIVATE(hook, priv);
168
169         return (0);
170 }
171
172 /*
173  * Receive a control message.
174  */
175 static int
176 ng_tcpmss_rcvmsg
177 (node_p node, item_p item, hook_p lasthook)
178 {
179         struct ng_mesg *msg, *resp = NULL;
180         int error = 0;
181
182         NGI_GET_MSG(item, msg);
183
184         switch (msg->header.typecookie) {
185         case NGM_TCPMSS_COOKIE:
186                 switch (msg->header.cmd) {
187                 case NGM_TCPMSS_GET_STATS:
188                 case NGM_TCPMSS_CLR_STATS:
189                 case NGM_TCPMSS_GETCLR_STATS:
190                     {
191                         hook_p hook;
192                         hpriv_p priv;
193
194                         /* Check that message is long enough. */
195                         if (msg->header.arglen != NG_HOOKSIZ)
196                                 ERROUT(EINVAL);
197
198                         /* Find this hook. */
199                         hook = ng_findhook(node, (char *)msg->data);
200                         if (hook == NULL)
201                                 ERROUT(ENOENT);
202
203                         priv = NG_HOOK_PRIVATE(hook);
204
205                         /* Create response. */
206                         if (msg->header.cmd != NGM_TCPMSS_CLR_STATS) {
207                                 NG_MKRESPONSE(resp, msg,
208                                     sizeof(struct ng_tcpmss_hookstat), M_WAITOK | M_NULLOK);
209                                 if (resp == NULL)
210                                         ERROUT(ENOMEM);
211                                 bcopy(&priv->stats, resp->data,
212                                     sizeof(struct ng_tcpmss_hookstat)); 
213                         }
214
215                         if (msg->header.cmd != NGM_TCPMSS_GET_STATS)
216                                 bzero(&priv->stats,
217                                     sizeof(struct ng_tcpmss_hookstat));
218                         break;
219                     }
220                 case NGM_TCPMSS_CONFIG:
221                     {
222                         struct ng_tcpmss_config *set;
223                         hook_p in, out;
224                         hpriv_p priv;
225
226                         /* Check that message is long enough. */
227                         if (msg->header.arglen !=
228                             sizeof(struct ng_tcpmss_config))
229                                 ERROUT(EINVAL);
230
231                         set = (struct ng_tcpmss_config *)msg->data;
232                         in = ng_findhook(node, set->inHook);
233                         out = ng_findhook(node, set->outHook);
234                         if (in == NULL || out == NULL)
235                                 ERROUT(ENOENT);
236
237                         /* Configure MSS hack. */
238                         priv = NG_HOOK_PRIVATE(in);
239                         priv->outHook = out;
240                         priv->stats.maxMSS = set->maxMSS;
241
242                         break;
243                     }
244                 default:
245                         error = EINVAL;
246                         break;
247                 }
248                 break;
249         default:
250                 error = EINVAL;
251                 break;
252         }
253
254 done:
255         NG_RESPOND_MSG(error, node, item, resp);
256         NG_FREE_MSG(msg);
257
258         return (error);
259 }
260
261 /*
262  * Receive data on a hook, and hack MSS.
263  *
264  */
265 static int
266 ng_tcpmss_rcvdata(hook_p hook, item_p item)
267 {
268         hpriv_p priv = NG_HOOK_PRIVATE(hook);
269         struct mbuf *m = NULL;
270         struct ip *ip;
271         struct tcphdr *tcp;
272         int iphlen, tcphlen, pktlen;
273         int pullup_len = 0;
274         int error = 0;
275
276         /* Drop packets if filter is not configured on this hook. */
277         if (priv->outHook == NULL)
278                 goto done;
279
280         NGI_GET_M(item, m);
281
282         /* Update stats on incoming hook. */
283         pktlen = m->m_pkthdr.len;
284         priv->stats.Octets += pktlen;
285         priv->stats.Packets++;
286
287         /* Check whether we configured to fix MSS. */
288         if (priv->stats.maxMSS == 0)
289                 goto send;
290
291 #define M_CHECK(length) do {                                    \
292         pullup_len += length;                                   \
293         if ((m)->m_pkthdr.len < pullup_len)                     \
294                 goto send;                                      \
295         if ((m)->m_len < pullup_len &&                          \
296            (((m) = m_pullup((m), pullup_len)) == NULL))         \
297                 ERROUT(ENOBUFS);                                \
298         } while (0)
299
300         /* Check mbuf packet size and arrange for IP header. */
301         M_CHECK(sizeof(struct ip));
302         ip = mtod(m, struct ip *);
303
304         /* Check IP version. */
305         if (ip->ip_v != IPVERSION)
306                 ERROUT(EINVAL);
307
308         /* Check IP header length. */
309         iphlen = ip->ip_hl << 2;
310         if (iphlen < sizeof(struct ip) || iphlen > pktlen )
311                 ERROUT(EINVAL);
312
313         /* Check if it is TCP. */
314         if (!(ip->ip_p == IPPROTO_TCP))
315                 goto send;
316
317         /* Check mbuf packet size and arrange for IP+TCP header */
318         M_CHECK(iphlen - sizeof(struct ip) + sizeof(struct tcphdr));
319         ip = mtod(m, struct ip *);
320         tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
321
322         /* Check TCP header length. */
323         tcphlen = tcp->th_off << 2;
324         if (tcphlen < sizeof(struct tcphdr) || tcphlen > pktlen - iphlen)
325                 ERROUT(EINVAL);
326
327         /* Check SYN packet and has options. */
328         if (!(tcp->th_flags & TH_SYN) || tcphlen == sizeof(struct tcphdr))
329                 goto send;
330         
331         /* Update SYN stats. */
332         priv->stats.SYNPkts++;
333
334         M_CHECK(tcphlen - sizeof(struct tcphdr));
335         ip = mtod(m, struct ip *);
336         tcp = (struct tcphdr *)((caddr_t )ip + iphlen);
337
338 #undef  M_CHECK
339
340         /* Fix MSS and update stats. */
341         if (correct_mss(tcp, tcphlen, priv->stats.maxMSS,
342             m->m_pkthdr.csum_flags))
343                 priv->stats.FixedPkts++;
344
345 send:
346         /* Deliver frame out destination hook. */
347         NG_FWD_NEW_DATA(error, item, priv->outHook, m);
348
349         return (error);
350
351 done:
352         NG_FREE_ITEM(item);
353         NG_FREE_M(m);
354
355         return (error);
356 }
357
358 /*
359  * Hook disconnection.
360  * We must check all hooks, since they may reference this one.
361  */
362 static int
363 ng_tcpmss_disconnect(hook_p hook)
364 {
365         node_p node = NG_HOOK_NODE(hook);
366         hook_p hook2;
367
368         LIST_FOREACH(hook2, &node->nd_hooks, hk_hooks) {
369                 hpriv_p priv = NG_HOOK_PRIVATE(hook2);
370
371                 if (priv->outHook == hook)
372                         priv->outHook = NULL;
373         }
374
375         FREE(NG_HOOK_PRIVATE(hook), M_NETGRAPH);
376
377         if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0)
378                 ng_rmnode_self(NG_HOOK_NODE(hook));
379
380         return (0);
381 }
382
383 /*
384  * Code from tcpmssd.
385  */
386
387 /*-
388  * The following macro is used to update an
389  * internet checksum.  "acc" is a 32-bit
390  * accumulation of all the changes to the
391  * checksum (adding in old 16-bit words and
392  * subtracting out new words), and "cksum"
393  * is the checksum value to be updated.
394  */
395 #define TCPMSS_ADJUST_CHECKSUM(acc, cksum) do {         \
396         acc += cksum;                                   \
397         if (acc < 0) {                                  \
398                 acc = -acc;                             \
399                 acc = (acc >> 16) + (acc & 0xffff);     \
400                 acc += acc >> 16;                       \
401                 cksum = (u_short) ~acc;                 \
402         } else {                                        \
403                 acc = (acc >> 16) + (acc & 0xffff);     \
404                 acc += acc >> 16;                       \
405                 cksum = (u_short) acc;                  \
406         }                                               \
407 } while (0);
408
409 static int
410 correct_mss(struct tcphdr *tc, int hlen, uint16_t maxmss, int flags)
411 {
412         int olen, optlen;
413         u_char *opt;
414         uint16_t *mss;
415         int accumulate;
416         int res = 0;
417
418         for (olen = hlen - sizeof(struct tcphdr), opt = (u_char *)(tc + 1);
419              olen > 0; olen -= optlen, opt += optlen) {
420                 if (*opt == TCPOPT_EOL)
421                         break;
422                 else if (*opt == TCPOPT_NOP)
423                         optlen = 1;
424                 else {
425                         optlen = *(opt + 1);
426                         if (optlen <= 0 || optlen > olen)
427                                 break;
428                         if (*opt == TCPOPT_MAXSEG) {
429                                 if (optlen != TCPOLEN_MAXSEG)
430                                         continue;
431                                 mss = (uint16_t *)(opt + 2);
432                                 if (ntohs(*mss) > maxmss) {
433                                         accumulate = *mss;
434                                         *mss = htons(maxmss);
435                                         accumulate -= *mss;
436                                         if ((flags & CSUM_TCP) == 0)
437                                                 TCPMSS_ADJUST_CHECKSUM(accumulate, tc->th_sum);
438                                         res = 1;
439                                 }
440                         }
441                 }
442         }
443         return (res);
444 }