Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 3 Apr 2017 03:07:48 +0000 (UTC)
From:      "Andrey V. Elsukov" <ae@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r316435 - in head: sbin/ipfw sys/conf sys/modules sys/modules/ipfw_pmod sys/netpfil/ipfw/pmod
Message-ID:  <201704030307.v3337mfs039014@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: ae
Date: Mon Apr  3 03:07:48 2017
New Revision: 316435
URL: https://svnweb.freebsd.org/changeset/base/316435

Log:
  Add ipfw_pmod kernel module.
  
  The module is designed for modification of a packets of any protocols.
  For now it implements only TCP MSS modification. It adds the external
  action handler for "tcp-setmss" action.
  
  A rule with tcp-setmss action does additional check for protocol and
  TCP flags. If SYN flag is present, it parses TCP options and modifies
  MSS option if its value is greater than configured value in the rule.
  Then it adjustes TCP checksum if needed. After handling the search
  continues with the next rule.
  
  Obtained from:	Yandex LLC
  MFC after:	2 weeks
  Relnotes:	yes
  Sponsored by:	Yandex LLC
  No objection from: #network
  Differential Revision:	https://reviews.freebsd.org/D10150

Added:
  head/sys/modules/ipfw_pmod/
  head/sys/modules/ipfw_pmod/Makefile   (contents, props changed)
  head/sys/netpfil/ipfw/pmod/
  head/sys/netpfil/ipfw/pmod/ip_fw_pmod.c   (contents, props changed)
  head/sys/netpfil/ipfw/pmod/pmod.h   (contents, props changed)
  head/sys/netpfil/ipfw/pmod/tcpmod.c   (contents, props changed)
Modified:
  head/sbin/ipfw/ipfw.8
  head/sbin/ipfw/ipfw2.c
  head/sbin/ipfw/ipfw2.h
  head/sys/conf/NOTES
  head/sys/conf/files
  head/sys/conf/options
  head/sys/modules/Makefile

Modified: head/sbin/ipfw/ipfw.8
==============================================================================
--- head/sbin/ipfw/ipfw.8	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sbin/ipfw/ipfw.8	Mon Apr  3 03:07:48 2017	(r316435)
@@ -1,7 +1,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd March 15, 2017
+.Dd April 3, 2017
 .Dt IPFW 8
 .Os
 .Sh NAME
@@ -1118,6 +1118,20 @@ It is also possible to use the
 keyword with setdscp.
 If the tablearg value is not within the 0..64 range, lower 6 bits of supplied
 value are used.
+.It Cm tcp-setmss Ar mss
+Set the Maximum Segment Size (MSS) in the TCP segment to value
+.Ar mss .
+The kernel module
+.Cm ipfw_pmod
+should be loaded or kernel should have
+.Cm options IPFIREWALL_PMOD
+to be able use this action.
+This command does not change a packet if original MSS value is lower than
+specified value.
+Both TCP over IPv4 and over IPv6 are supported.
+Regardless of matched a packet or not by the
+.Cm tcp-setmss
+rule, the search continues with the next rule.
 .It Cm reass
 Queue and reassemble IP fragments.
 If the packet is not fragmented, counters are updated and

Modified: head/sbin/ipfw/ipfw2.c
==============================================================================
--- head/sbin/ipfw/ipfw2.c	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sbin/ipfw/ipfw2.c	Mon Apr  3 03:07:48 2017	(r316435)
@@ -36,6 +36,7 @@
 #include <pwd.h>
 #include <stdio.h>
 #include <stdarg.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sysexits.h>
@@ -238,6 +239,7 @@ static struct _s_x rule_eactions[] = {
 	{ "nat64lsn",		TOK_NAT64LSN },
 	{ "nat64stl",		TOK_NAT64STL },
 	{ "nptv6",		TOK_NPTV6 },
+	{ "tcp-setmss",		TOK_TCPSETMSS },
 	{ NULL, 0 }	/* terminator */
 };
 
@@ -272,6 +274,7 @@ static struct _s_x rule_actions[] = {
 	{ "call",		TOK_CALL },
 	{ "return",		TOK_RETURN },
 	{ "eaction",		TOK_EACTION },
+	{ "tcp-setmss",		TOK_TCPSETMSS },
 	{ NULL, 0 }	/* terminator */
 };
 
@@ -4007,6 +4010,26 @@ chkarg:
 		fill_cmd(action, O_CALLRETURN, F_NOT, 0);
 		break;
 
+	case TOK_TCPSETMSS: {
+		u_long mss;
+		uint16_t idx;
+
+		idx = pack_object(tstate, "tcp-setmss", IPFW_TLV_EACTION);
+		if (idx == 0)
+			errx(EX_DATAERR, "pack_object failed");
+		fill_cmd(action, O_EXTERNAL_ACTION, 0, idx);
+		NEED1("Missing MSS value");
+		action = next_cmd(action, &ablen);
+		action->len = 1;
+		CHECK_ACTLEN;
+		mss = strtoul(*av, NULL, 10);
+		if (mss == 0 || mss > UINT16_MAX)
+			errx(EX_USAGE, "invalid MSS value %s", *av);
+		fill_cmd(action, O_EXTERNAL_DATA, 0, (uint16_t)mss);
+		av++;
+		break;
+	}
+
 	default:
 		av--;
 		if (match_token(rule_eactions, *av) == -1)

Modified: head/sbin/ipfw/ipfw2.h
==============================================================================
--- head/sbin/ipfw/ipfw2.h	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sbin/ipfw/ipfw2.h	Mon Apr  3 03:07:48 2017	(r316435)
@@ -284,6 +284,8 @@ enum tokens {
 	TOK_INTPREFIX,
 	TOK_EXTPREFIX,
 	TOK_PREFIXLEN,
+
+	TOK_TCPSETMSS,
 };
 
 /*

Modified: head/sys/conf/NOTES
==============================================================================
--- head/sys/conf/NOTES	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sys/conf/NOTES	Mon Apr  3 03:07:48 2017	(r316435)
@@ -971,6 +971,9 @@ device		lagg
 #
 # IPFIREWALL_NPTV6 adds support for in kernel NPTv6 in ipfw.
 #
+# IPFIREWALL_PMOD adds support for protocols modification module. Currently
+# it supports only TCP MSS modification.
+#
 # IPSTEALTH enables code to support stealth forwarding (i.e., forwarding
 # packets without touching the TTL).  This can be useful to hide firewalls
 # from traceroute and similar tools.

Modified: head/sys/conf/files
==============================================================================
--- head/sys/conf/files	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sys/conf/files	Mon Apr  3 03:07:48 2017	(r316435)
@@ -4230,6 +4230,8 @@ netpfil/ipfw/nptv6/ip_fw_nptv6.c	optiona
 	ipfirewall_nptv6
 netpfil/ipfw/nptv6/nptv6.c	optional inet inet6 ipfirewall \
 	ipfirewall_nptv6
+netpfil/ipfw/pmod/ip_fw_pmod.c	optional inet ipfirewall_pmod
+netpfil/ipfw/pmod/tcpmod.c	optional inet ipfirewall_pmod
 netpfil/pf/if_pflog.c		optional pflog pf inet
 netpfil/pf/if_pfsync.c		optional pfsync pf inet
 netpfil/pf/pf.c			optional pf inet

Modified: head/sys/conf/options
==============================================================================
--- head/sys/conf/options	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sys/conf/options	Mon Apr  3 03:07:48 2017	(r316435)
@@ -426,6 +426,7 @@ IPFIREWALL_NAT64_DIRECT_OUTPUT	opt_ipfw.
 IPFIREWALL_NPTV6	opt_ipfw.h
 IPFIREWALL_VERBOSE	opt_ipfw.h
 IPFIREWALL_VERBOSE_LIMIT	opt_ipfw.h
+IPFIREWALL_PMOD		opt_ipfw.h
 IPSEC			opt_ipsec.h
 IPSEC_DEBUG		opt_ipsec.h
 IPSEC_SUPPORT		opt_ipsec.h

Modified: head/sys/modules/Makefile
==============================================================================
--- head/sys/modules/Makefile	Mon Apr  3 02:44:40 2017	(r316434)
+++ head/sys/modules/Makefile	Mon Apr  3 03:07:48 2017	(r316435)
@@ -173,6 +173,7 @@ SUBDIR=	\
 	ipfw_nat \
 	${_ipfw_nat64} \
 	${_ipfw_nptv6} \
+	${_ipfw_pmod} \
 	${_ipmi} \
 	ip6_mroute_mod \
 	ip_mroute_mod \
@@ -443,6 +444,7 @@ _toecore=	toecore
 _if_enc=	if_enc
 _if_gif=	if_gif
 _if_gre=	if_gre
+_ipfw_pmod=	ipfw_pmod
 .if ${MK_IPSEC_SUPPORT} != "no"
 _ipsec=		ipsec
 .endif

Added: head/sys/modules/ipfw_pmod/Makefile
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/modules/ipfw_pmod/Makefile	Mon Apr  3 03:07:48 2017	(r316435)
@@ -0,0 +1,8 @@
+# $FreeBSD$
+
+.PATH: ${SRCTOP}/sys/netpfil/ipfw/pmod
+
+KMOD=   ipfw_pmod
+SRCS=   ip_fw_pmod.c tcpmod.c opt_inet.h opt_inet6.h
+
+.include <bsd.kmod.mk>

Added: head/sys/netpfil/ipfw/pmod/ip_fw_pmod.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/netpfil/ipfw/pmod/ip_fw_pmod.c	Mon Apr  3 03:07:48 2017	(r316435)
@@ -0,0 +1,101 @@
+/*-
+ * Copyright (c) 2017 Yandex LLC
+ * Copyright (c) 2017 Andrey V. Elsukov <ae@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/rwlock.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/vnet.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip_fw.h>
+
+#include <netpfil/ipfw/ip_fw_private.h>
+#include <netpfil/ipfw/pmod/pmod.h>
+
+static int
+vnet_ipfw_pmod_init(const void *arg __unused)
+{
+	int error;
+
+	error = tcpmod_init(&V_layer3_chain, IS_DEFAULT_VNET(curvnet));
+	return (error);
+}
+
+static int
+vnet_ipfw_pmod_uninit(const void *arg __unused)
+{
+
+	tcpmod_uninit(&V_layer3_chain, IS_DEFAULT_VNET(curvnet));
+	return (0);
+}
+
+static int
+ipfw_pmod_modevent(module_t mod, int type, void *unused)
+{
+
+	switch (type) {
+	case MOD_LOAD:
+	case MOD_UNLOAD:
+		break;
+	default:
+		return (EOPNOTSUPP);
+	}
+	return (0);
+}
+
+static moduledata_t ipfw_pmod_mod = {
+	"ipfw_pmod",
+	ipfw_pmod_modevent,
+	0
+};
+
+/* Define startup order. */
+#define	IPFW_PMOD_SI_SUB_FIREWALL	SI_SUB_PROTO_IFATTACHDOMAIN
+#define	IPFW_PMOD_MODEVENT_ORDER	(SI_ORDER_ANY - 128) /* after ipfw */
+#define	IPFW_PMOD_MODULE_ORDER		(IPFW_PMOD_MODEVENT_ORDER + 1)
+#define	IPFW_PMOD_VNET_ORDER		(IPFW_PMOD_MODEVENT_ORDER + 2)
+
+DECLARE_MODULE(ipfw_pmod, ipfw_pmod_mod, IPFW_PMOD_SI_SUB_FIREWALL,
+    IPFW_PMOD_MODULE_ORDER);
+MODULE_DEPEND(ipfw_pmod, ipfw, 3, 3, 3);
+MODULE_VERSION(ipfw_pmod, 1);
+
+VNET_SYSINIT(vnet_ipfw_pmod_init, IPFW_PMOD_SI_SUB_FIREWALL,
+    IPFW_PMOD_VNET_ORDER, vnet_ipfw_pmod_init, NULL);
+VNET_SYSUNINIT(vnet_ipfw_pmod_uninit, IPFW_PMOD_SI_SUB_FIREWALL,
+    IPFW_PMOD_VNET_ORDER, vnet_ipfw_pmod_uninit, NULL);

Added: head/sys/netpfil/ipfw/pmod/pmod.h
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/netpfil/ipfw/pmod/pmod.h	Mon Apr  3 03:07:48 2017	(r316435)
@@ -0,0 +1,36 @@
+/*-
+ * Copyright (c) 2017 Yandex LLC
+ * Copyright (c) 2017 Andrey V. Elsukov <ae@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef	_IP_FW_PMOD_H_
+#define	_IP_FW_PMOD_H_
+
+int tcpmod_init(struct ip_fw_chain *ch, int first);
+void tcpmod_uninit(struct ip_fw_chain *ch, int last);
+#endif /* _IP_FW_PMOD_H_ */
+

Added: head/sys/netpfil/ipfw/pmod/tcpmod.c
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ head/sys/netpfil/ipfw/pmod/tcpmod.c	Mon Apr  3 03:07:48 2017	(r316435)
@@ -0,0 +1,246 @@
+/*-
+ * Copyright (c) 2017 Yandex LLC
+ * Copyright (c) 2017 Andrey V. Elsukov <ae@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "opt_inet.h"
+#include "opt_inet6.h"
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/errno.h>
+#include <sys/kernel.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/pfil.h>
+#include <net/vnet.h>
+
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/tcp.h>
+#include <netinet/ip_fw.h>
+#include <netinet/ip6.h>
+
+#include <netpfil/ipfw/ip_fw_private.h>
+#include <netpfil/ipfw/pmod/pmod.h>
+
+#include <machine/in_cksum.h>
+
+static VNET_DEFINE(uint16_t, tcpmod_setmss_eid) = 0;
+#define	V_tcpmod_setmss_eid	VNET(tcpmod_setmss_eid)
+
+static int
+tcpmod_setmss(struct mbuf **mp, struct tcphdr *tcp, int tlen, uint16_t mss)
+{
+	struct mbuf *m;
+	u_char *cp;
+	int optlen, ret;
+	uint16_t oldmss, csum;
+
+	m = *mp;
+	ret = IP_FW_DENY;
+	if (m->m_len < m->m_pkthdr.len) {
+		/*
+		 * We shouldn't have any data, IP packet contains only
+		 * TCP header with options.
+		 */
+		*mp = m = m_pullup(m, m->m_pkthdr.len);
+		if (m == NULL)
+			return (ret);
+	}
+	/* Parse TCP options. */
+	for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1);
+	    tlen > 0; tlen -= optlen, cp += optlen) {
+		if (cp[0] == TCPOPT_EOL)
+			break;
+		if (cp[0] == TCPOPT_NOP) {
+			optlen = 1;
+			continue;
+		}
+		if (tlen < 2)
+			break;
+		optlen = cp[1];
+		if (optlen < 2 || optlen > tlen)
+			break;
+		if (cp[0] == TCPOPT_MAXSEG) {
+			if (optlen != TCPOLEN_MAXSEG)
+				break;
+			ret = 0; /* report success */
+			bcopy(cp + 2, &oldmss, sizeof(oldmss));
+			/* Do not update lower MSS value */
+			if (oldmss <= mss)
+				break;
+			bcopy(&mss, cp + 2, sizeof(mss));
+			/* Update checksum if it is not delayed. */
+			if ((m->m_pkthdr.csum_flags &
+			    (CSUM_TCP | CSUM_TCP_IPV6)) == 0) {
+				bcopy(&tcp->th_sum, &csum, sizeof(csum));
+				csum = cksum_adjust(csum, oldmss, mss);
+				bcopy(&csum, &tcp->th_sum, sizeof(csum));
+			}
+			break;
+		}
+	}
+
+	return (ret);
+}
+
+#ifdef INET6
+static int
+tcpmod_ipv6_setmss(struct mbuf **mp, uint16_t mss)
+{
+	struct ip6_hdr *ip6;
+	struct ip6_hbh *hbh;
+	struct tcphdr *tcp;
+	int hlen, plen, proto;
+
+	ip6 = mtod(*mp, struct ip6_hdr *);
+	hlen = sizeof(*ip6);
+	proto = ip6->ip6_nxt;
+	/*
+	 * Skip IPv6 extension headers and get the TCP header.
+	 * ipfw_chk() has already done this work. So we are sure that
+	 * we will not do an access to the out of bounds. For this
+	 * reason we skip some checks here.
+	 */
+	while (proto == IPPROTO_HOPOPTS || proto == IPPROTO_ROUTING ||
+	    proto == IPPROTO_DSTOPTS) {
+		hbh = mtodo(*mp, hlen);
+		proto = hbh->ip6h_nxt;
+		hlen += hbh->ip6h_len << 3;
+	}
+	tcp = mtodo(*mp, hlen);
+	plen = (*mp)->m_pkthdr.len - hlen;
+	hlen = tcp->th_off << 2;
+	/* We must have TCP options and enough data in a packet. */
+	if (hlen <= sizeof(struct tcphdr) || hlen > plen)
+		return (IP_FW_DENY);
+	return (tcpmod_setmss(mp, tcp, hlen, mss));
+}
+#endif /* INET6 */
+
+#ifdef INET
+static int
+tcpmod_ipv4_setmss(struct mbuf **mp, uint16_t mss)
+{
+	struct tcphdr *tcp;
+	struct ip *ip;
+	int hlen, plen;
+
+	ip = mtod(*mp, struct ip *);
+	hlen = ip->ip_hl << 2;
+	tcp = mtodo(*mp, hlen);
+	plen = (*mp)->m_pkthdr.len - hlen;
+	hlen = tcp->th_off << 2;
+	/* We must have TCP options and enough data in a packet. */
+	if (hlen <= sizeof(struct tcphdr) || hlen > plen)
+		return (IP_FW_DENY);
+	return (tcpmod_setmss(mp, tcp, hlen, mss));
+}
+#endif /* INET */
+
+/*
+ * ipfw external action handler.
+ */
+static int
+ipfw_tcpmod(struct ip_fw_chain *chain, struct ip_fw_args *args,
+    ipfw_insn *cmd, int *done)
+{
+	ipfw_insn *icmd;
+	int ret;
+
+	*done = 0; /* try next rule if not matched */
+	ret = IP_FW_DENY;
+	icmd = cmd + 1;
+	if (cmd->opcode != O_EXTERNAL_ACTION ||
+	    cmd->arg1 != V_tcpmod_setmss_eid ||
+	    icmd->opcode != O_EXTERNAL_DATA ||
+	    icmd->len != F_INSN_SIZE(ipfw_insn))
+		return (ret);
+
+	/*
+	 * NOTE: ipfw_chk() can set f_id.proto from IPv6 fragment header,
+	 * but f_id._flags can be filled only from real TCP header.
+	 *
+	 * NOTE: ipfw_chk() drops very short packets in the PULLUP_TO()
+	 * macro. But we need to check that mbuf is contiguous more than
+	 * IP+IP_options/IP_extensions+tcphdr length, because TCP header
+	 * must have TCP options, and ipfw_chk() does PULLUP_TO() size of
+	 * struct tcphdr.
+	 *
+	 * NOTE: we require only the presence of SYN flag. User should
+	 * properly configure the rule to select the direction of packets,
+	 * that should be modified.
+	 */
+	if (args->f_id.proto != IPPROTO_TCP ||
+	    (args->f_id._flags & TH_SYN) == 0)
+		return (ret);
+
+	switch (args->f_id.addr_type) {
+#ifdef INET
+		case 4:
+			ret = tcpmod_ipv4_setmss(&args->m, htons(icmd->arg1));
+			break;
+#endif
+#ifdef INET6
+		case 6:
+			ret = tcpmod_ipv6_setmss(&args->m, htons(icmd->arg1));
+			break;
+#endif
+	}
+	/*
+	 * We return zero in both @ret and @done on success, and ipfw_chk()
+	 * will update rule counters. Otherwise a packet will not be matched
+	 * by rule.
+	 */
+	return (ret);
+}
+
+int
+tcpmod_init(struct ip_fw_chain *ch, int first)
+{
+
+	V_tcpmod_setmss_eid = ipfw_add_eaction(ch, ipfw_tcpmod, "tcp-setmss");
+	if (V_tcpmod_setmss_eid == 0)
+		return (ENXIO);
+	return (0);
+}
+
+void
+tcpmod_uninit(struct ip_fw_chain *ch, int last)
+{
+
+	ipfw_del_eaction(ch, V_tcpmod_setmss_eid);
+	V_tcpmod_setmss_eid = 0;
+}
+



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201704030307.v3337mfs039014>