npf_ext_normalize.c revision 1.2.2.2
1 1.2.2.2 yamt /* $NetBSD: npf_ext_normalize.c,v 1.2.2.2 2014/05/22 11:41:09 yamt Exp $ */ 2 1.2.2.2 yamt 3 1.2.2.2 yamt /*- 4 1.2.2.2 yamt * Copyright (c) 2009-2012 The NetBSD Foundation, Inc. 5 1.2.2.2 yamt * All rights reserved. 6 1.2.2.2 yamt * 7 1.2.2.2 yamt * Redistribution and use in source and binary forms, with or without 8 1.2.2.2 yamt * modification, are permitted provided that the following conditions 9 1.2.2.2 yamt * are met: 10 1.2.2.2 yamt * 1. Redistributions of source code must retain the above copyright 11 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer. 12 1.2.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 13 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer in the 14 1.2.2.2 yamt * documentation and/or other materials provided with the distribution. 15 1.2.2.2 yamt * 16 1.2.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 1.2.2.2 yamt * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 1.2.2.2 yamt * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 1.2.2.2 yamt * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 1.2.2.2 yamt * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 1.2.2.2 yamt * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 1.2.2.2 yamt * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 1.2.2.2 yamt * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 1.2.2.2 yamt * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 1.2.2.2 yamt * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 1.2.2.2 yamt * POSSIBILITY OF SUCH DAMAGE. 27 1.2.2.2 yamt */ 28 1.2.2.2 yamt 29 1.2.2.2 yamt #include <sys/cdefs.h> 30 1.2.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: npf_ext_normalize.c,v 1.2.2.2 2014/05/22 11:41:09 yamt Exp $"); 31 1.2.2.2 yamt 32 1.2.2.2 yamt #include <sys/types.h> 33 1.2.2.2 yamt #include <sys/module.h> 34 1.2.2.2 yamt #include <sys/kmem.h> 35 1.2.2.2 yamt 36 1.2.2.2 yamt #include <net/if.h> 37 1.2.2.2 yamt #include <netinet/in_systm.h> 38 1.2.2.2 yamt #include <netinet/in.h> 39 1.2.2.2 yamt #include <netinet/in_var.h> 40 1.2.2.2 yamt 41 1.2.2.2 yamt #include "npf.h" 42 1.2.2.2 yamt #include "npf_impl.h" 43 1.2.2.2 yamt 44 1.2.2.2 yamt /* 45 1.2.2.2 yamt * NPF extension module definition and the identifier. 46 1.2.2.2 yamt */ 47 1.2.2.2 yamt NPF_EXT_MODULE(npf_ext_normalize, ""); 48 1.2.2.2 yamt 49 1.2.2.2 yamt #define NPFEXT_NORMALIZE_VER 1 50 1.2.2.2 yamt 51 1.2.2.2 yamt static void * npf_ext_normalize_id; 52 1.2.2.2 yamt 53 1.2.2.2 yamt /* 54 1.2.2.2 yamt * Normalisation parameters. 55 1.2.2.2 yamt */ 56 1.2.2.2 yamt typedef struct { 57 1.2.2.2 yamt u_int n_minttl; 58 1.2.2.2 yamt u_int n_maxmss; 59 1.2.2.2 yamt bool n_random_id; 60 1.2.2.2 yamt bool n_no_df; 61 1.2.2.2 yamt } npf_normalize_t; 62 1.2.2.2 yamt 63 1.2.2.2 yamt /* 64 1.2.2.2 yamt * npf_normalize_ctor: a constructor for the normalisation rule procedure 65 1.2.2.2 yamt * with the given parameters. 66 1.2.2.2 yamt */ 67 1.2.2.2 yamt static int 68 1.2.2.2 yamt npf_normalize_ctor(npf_rproc_t *rp, prop_dictionary_t params) 69 1.2.2.2 yamt { 70 1.2.2.2 yamt npf_normalize_t *np; 71 1.2.2.2 yamt 72 1.2.2.2 yamt /* Create a structure for normalisation parameters. */ 73 1.2.2.2 yamt np = kmem_zalloc(sizeof(npf_normalize_t), KM_SLEEP); 74 1.2.2.2 yamt 75 1.2.2.2 yamt /* IP ID randomisation and IP_DF flag cleansing. */ 76 1.2.2.2 yamt prop_dictionary_get_bool(params, "random-id", &np->n_random_id); 77 1.2.2.2 yamt prop_dictionary_get_bool(params, "no-df", &np->n_no_df); 78 1.2.2.2 yamt 79 1.2.2.2 yamt /* Minimum IP TTL and maximum TCP MSS. */ 80 1.2.2.2 yamt prop_dictionary_get_uint32(params, "min-ttl", &np->n_minttl); 81 1.2.2.2 yamt prop_dictionary_get_uint32(params, "max-mss", &np->n_maxmss); 82 1.2.2.2 yamt 83 1.2.2.2 yamt /* Assign the parameters for this rule procedure. */ 84 1.2.2.2 yamt npf_rproc_assign(rp, np); 85 1.2.2.2 yamt return 0; 86 1.2.2.2 yamt } 87 1.2.2.2 yamt 88 1.2.2.2 yamt /* 89 1.2.2.2 yamt * npf_normalize_dtor: a destructor for a normalisation rule procedure. 90 1.2.2.2 yamt */ 91 1.2.2.2 yamt static void 92 1.2.2.2 yamt npf_normalize_dtor(npf_rproc_t *rp, void *params) 93 1.2.2.2 yamt { 94 1.2.2.2 yamt /* Free our meta-data, associated with the procedure. */ 95 1.2.2.2 yamt kmem_free(params, sizeof(npf_normalize_t)); 96 1.2.2.2 yamt } 97 1.2.2.2 yamt 98 1.2.2.2 yamt /* 99 1.2.2.2 yamt * npf_normalize_ip4: routine to normalize IPv4 header (randomise ID, 100 1.2.2.2 yamt * clear "don't fragment" and/or enforce minimum TTL). 101 1.2.2.2 yamt */ 102 1.2.2.2 yamt static inline void 103 1.2.2.2 yamt npf_normalize_ip4(npf_cache_t *npc, npf_normalize_t *np) 104 1.2.2.2 yamt { 105 1.2.2.2 yamt struct ip *ip = npc->npc_ip.v4; 106 1.2.2.2 yamt uint16_t cksum = ip->ip_sum; 107 1.2.2.2 yamt uint16_t ip_off = ip->ip_off; 108 1.2.2.2 yamt uint8_t ttl = ip->ip_ttl; 109 1.2.2.2 yamt u_int minttl = np->n_minttl; 110 1.2.2.2 yamt 111 1.2.2.2 yamt KASSERT(np->n_random_id || np->n_no_df || minttl); 112 1.2.2.2 yamt 113 1.2.2.2 yamt /* Randomise IPv4 ID. */ 114 1.2.2.2 yamt if (np->n_random_id) { 115 1.2.2.2 yamt uint16_t oid = ip->ip_id, nid; 116 1.2.2.2 yamt 117 1.2.2.2 yamt nid = htons(ip_randomid(ip_ids, 0)); 118 1.2.2.2 yamt cksum = npf_fixup16_cksum(cksum, oid, nid); 119 1.2.2.2 yamt ip->ip_id = nid; 120 1.2.2.2 yamt } 121 1.2.2.2 yamt 122 1.2.2.2 yamt /* IP_DF flag cleansing. */ 123 1.2.2.2 yamt if (np->n_no_df && (ip_off & htons(IP_DF)) != 0) { 124 1.2.2.2 yamt uint16_t nip_off = ip_off & ~htons(IP_DF); 125 1.2.2.2 yamt 126 1.2.2.2 yamt cksum = npf_fixup16_cksum(cksum, ip_off, nip_off); 127 1.2.2.2 yamt ip->ip_off = nip_off; 128 1.2.2.2 yamt } 129 1.2.2.2 yamt 130 1.2.2.2 yamt /* Enforce minimum TTL. */ 131 1.2.2.2 yamt if (minttl && ttl < minttl) { 132 1.2.2.2 yamt cksum = npf_fixup16_cksum(cksum, ttl, minttl); 133 1.2.2.2 yamt ip->ip_ttl = minttl; 134 1.2.2.2 yamt } 135 1.2.2.2 yamt 136 1.2.2.2 yamt /* Update IPv4 checksum. */ 137 1.2.2.2 yamt ip->ip_sum = cksum; 138 1.2.2.2 yamt } 139 1.2.2.2 yamt 140 1.2.2.2 yamt /* 141 1.2.2.2 yamt * npf_normalize: the main routine to normalize IPv4 and/or TCP headers. 142 1.2.2.2 yamt */ 143 1.2.2.2 yamt static void 144 1.2.2.2 yamt npf_normalize(npf_cache_t *npc, nbuf_t *nbuf, void *params, int *decision) 145 1.2.2.2 yamt { 146 1.2.2.2 yamt npf_normalize_t *np = params; 147 1.2.2.2 yamt struct tcphdr *th = npc->npc_l4.tcp; 148 1.2.2.2 yamt uint16_t cksum, mss, maxmss = np->n_maxmss; 149 1.2.2.2 yamt int wscale; 150 1.2.2.2 yamt 151 1.2.2.2 yamt /* Skip, if already blocking. */ 152 1.2.2.2 yamt if (*decision == NPF_DECISION_BLOCK) { 153 1.2.2.2 yamt return; 154 1.2.2.2 yamt } 155 1.2.2.2 yamt 156 1.2.2.2 yamt /* Normalise IPv4. Nothing to do for IPv6. */ 157 1.2.2.2 yamt if (npf_iscached(npc, NPC_IP4) && (np->n_random_id || np->n_minttl)) { 158 1.2.2.2 yamt npf_normalize_ip4(npc, np); 159 1.2.2.2 yamt } 160 1.2.2.2 yamt 161 1.2.2.2 yamt /* 162 1.2.2.2 yamt * TCP Maximum Segment Size (MSS) "clamping". Only if SYN packet. 163 1.2.2.2 yamt * Fetch MSS and check whether rewrite to lower is needed. 164 1.2.2.2 yamt */ 165 1.2.2.2 yamt if (maxmss == 0 || !npf_iscached(npc, NPC_TCP) || 166 1.2.2.2 yamt (th->th_flags & TH_SYN) == 0) { 167 1.2.2.2 yamt /* Not required; done. */ 168 1.2.2.2 yamt return; 169 1.2.2.2 yamt } 170 1.2.2.2 yamt mss = 0; 171 1.2.2.2 yamt if (!npf_fetch_tcpopts(npc, nbuf, &mss, &wscale)) { 172 1.2.2.2 yamt return; 173 1.2.2.2 yamt } 174 1.2.2.2 yamt if (ntohs(mss) <= maxmss) { 175 1.2.2.2 yamt /* Nothing else to do. */ 176 1.2.2.2 yamt return; 177 1.2.2.2 yamt } 178 1.2.2.2 yamt maxmss = htons(maxmss); 179 1.2.2.2 yamt 180 1.2.2.2 yamt /* Store new MSS, calculate TCP checksum and update it. */ 181 1.2.2.2 yamt if (npf_fetch_tcpopts(npc, nbuf, &maxmss, &wscale)) { 182 1.2.2.2 yamt cksum = npf_fixup16_cksum(th->th_sum, mss, maxmss); 183 1.2.2.2 yamt th->th_sum = cksum; 184 1.2.2.2 yamt } 185 1.2.2.2 yamt } 186 1.2.2.2 yamt 187 1.2.2.2 yamt static int 188 1.2.2.2 yamt npf_ext_normalize_modcmd(modcmd_t cmd, void *arg) 189 1.2.2.2 yamt { 190 1.2.2.2 yamt static const npf_ext_ops_t npf_normalize_ops = { 191 1.2.2.2 yamt .version = NPFEXT_NORMALIZE_VER, 192 1.2.2.2 yamt .ctx = NULL, 193 1.2.2.2 yamt .ctor = npf_normalize_ctor, 194 1.2.2.2 yamt .dtor = npf_normalize_dtor, 195 1.2.2.2 yamt .proc = npf_normalize 196 1.2.2.2 yamt }; 197 1.2.2.2 yamt 198 1.2.2.2 yamt switch (cmd) { 199 1.2.2.2 yamt case MODULE_CMD_INIT: 200 1.2.2.2 yamt /* 201 1.2.2.2 yamt * Initialise normalisation module. Register the "normalize" 202 1.2.2.2 yamt * extension and its calls. 203 1.2.2.2 yamt */ 204 1.2.2.2 yamt npf_ext_normalize_id = 205 1.2.2.2 yamt npf_ext_register("normalize", &npf_normalize_ops); 206 1.2.2.2 yamt return npf_ext_normalize_id ? 0 : EEXIST; 207 1.2.2.2 yamt 208 1.2.2.2 yamt case MODULE_CMD_FINI: 209 1.2.2.2 yamt /* Unregister the normalisation rule procedure. */ 210 1.2.2.2 yamt return npf_ext_unregister(npf_ext_normalize_id); 211 1.2.2.2 yamt 212 1.2.2.2 yamt case MODULE_CMD_AUTOUNLOAD: 213 1.2.2.2 yamt return npf_autounload_p() ? 0 : EBUSY; 214 1.2.2.2 yamt 215 1.2.2.2 yamt default: 216 1.2.2.2 yamt return ENOTTY; 217 1.2.2.2 yamt } 218 1.2.2.2 yamt return 0; 219 1.2.2.2 yamt } 220
Indexes created Thu Oct 02 10:09:58 GMT 2025