1 | /* |
2 | * Copyright (c) 2007-2011 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* |
30 | * Copyright (c) 1991-1997 Regents of the University of California. |
31 | * All rights reserved. |
32 | * |
33 | * Redistribution and use in source and binary forms, with or without |
34 | * modification, are permitted provided that the following conditions |
35 | * are met: |
36 | * 1. Redistributions of source code must retain the above copyright |
37 | * notice, this list of conditions and the following disclaimer. |
38 | * 2. Redistributions in binary form must reproduce the above copyright |
39 | * notice, this list of conditions and the following disclaimer in the |
40 | * documentation and/or other materials provided with the distribution. |
41 | * 3. All advertising materials mentioning features or use of this software |
42 | * must display the following acknowledgement: |
43 | * This product includes software developed by the Network Research |
44 | * Group at Lawrence Berkeley Laboratory. |
45 | * 4. Neither the name of the University nor of the Laboratory may be used |
46 | * to endorse or promote products derived from this software without |
47 | * specific prior written permission. |
48 | * |
49 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
50 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
51 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
52 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
53 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
54 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
55 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
56 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
57 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
58 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
59 | * SUCH DAMAGE. |
60 | */ |
61 | |
62 | #include <sys/cdefs.h> |
63 | #include <sys/param.h> |
64 | #include <sys/mbuf.h> |
65 | #include <sys/errno.h> |
66 | #include <sys/random.h> |
67 | #include <sys/kernel_types.h> |
68 | #include <sys/sysctl.h> |
69 | |
70 | #include <net/if.h> |
71 | #include <net/net_osdep.h> |
72 | #include <net/classq/classq.h> |
73 | |
74 | #include <netinet/in.h> |
75 | #include <netinet/in_systm.h> |
76 | #include <netinet/ip.h> |
77 | #if INET6 |
78 | #include <netinet/ip6.h> |
79 | #endif |
80 | #include <netinet/tcp.h> |
81 | #include <netinet/udp.h> |
82 | |
83 | #include <libkern/libkern.h> |
84 | |
85 | #if PF_ECN |
86 | /* |
87 | * read and write diffserv field in IPv4 or IPv6 header |
88 | */ |
89 | u_int8_t |
90 | read_dsfield(struct mbuf *m, struct pf_mtag *t) |
91 | { |
92 | struct mbuf *m0; |
93 | u_int8_t ds_field = 0; |
94 | |
95 | if (t->pftag_hdr == NULL || |
96 | !(t->pftag_flags & (PF_TAG_HDR_INET|PF_TAG_HDR_INET6))) |
97 | return ((u_int8_t)0); |
98 | |
99 | /* verify that hdr is within the mbuf data */ |
100 | for (m0 = m; m0 != NULL; m0 = m0->m_next) |
101 | if (((caddr_t)t->pftag_hdr >= m0->m_data) && |
102 | ((caddr_t)t->pftag_hdr < m0->m_data + m0->m_len)) |
103 | break; |
104 | if (m0 == NULL) { |
105 | /* ick, tag info is stale */ |
106 | printf("%s: can't locate header!\n" , __func__); |
107 | return ((u_int8_t)0); |
108 | } |
109 | |
110 | if (t->pftag_flags & PF_TAG_HDR_INET) { |
111 | struct ip *ip = (struct ip *)(void *)t->pftag_hdr; |
112 | |
113 | if (((uintptr_t)ip + sizeof (*ip)) > |
114 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
115 | return (0); /* out of bounds */ |
116 | |
117 | if (ip->ip_v != 4) |
118 | return ((u_int8_t)0); /* version mismatch! */ |
119 | ds_field = ip->ip_tos; |
120 | } |
121 | #if INET6 |
122 | else if (t->pftag_flags & PF_TAG_HDR_INET6) { |
123 | struct ip6_hdr *ip6 = (struct ip6_hdr *)(void *)t->pftag_hdr; |
124 | u_int32_t flowlabel; |
125 | |
126 | if (((uintptr_t)ip6 + sizeof (*ip6)) > |
127 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
128 | return (0); /* out of bounds */ |
129 | |
130 | flowlabel = ntohl(ip6->ip6_flow); |
131 | if ((flowlabel >> 28) != 6) |
132 | return ((u_int8_t)0); /* version mismatch! */ |
133 | ds_field = (flowlabel >> 20) & 0xff; |
134 | } |
135 | #endif |
136 | return (ds_field); |
137 | } |
138 | |
139 | void |
140 | write_dsfield(struct mbuf *m, struct pf_mtag *t, u_int8_t dsfield) |
141 | { |
142 | struct mbuf *m0; |
143 | |
144 | if (t->pftag_hdr == NULL || |
145 | !(t->pftag_flags & (PF_TAG_HDR_INET|PF_TAG_HDR_INET6))) |
146 | return; |
147 | |
148 | /* verify that hdr is within the mbuf data */ |
149 | for (m0 = m; m0 != NULL; m0 = m0->m_next) |
150 | if (((caddr_t)t->pftag_hdr >= m0->m_data) && |
151 | ((caddr_t)t->pftag_hdr < m0->m_data + m0->m_len)) |
152 | break; |
153 | if (m0 == NULL) { |
154 | /* ick, tag info is stale */ |
155 | printf("%s: can't locate header!\n" , __func__); |
156 | return; |
157 | } |
158 | |
159 | if (t->pftag_flags & PF_TAG_HDR_INET) { |
160 | struct ip *ip = (struct ip *)(void *)t->pftag_hdr; |
161 | u_int8_t old; |
162 | int32_t sum; |
163 | |
164 | if (((uintptr_t)ip + sizeof (*ip)) > |
165 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
166 | return; /* out of bounds */ |
167 | |
168 | if (ip->ip_v != 4) |
169 | return; /* version mismatch! */ |
170 | old = ip->ip_tos; |
171 | dsfield |= old & 3; /* leave CU bits */ |
172 | if (old == dsfield) |
173 | return; |
174 | ip->ip_tos = dsfield; |
175 | /* |
176 | * update checksum (from RFC1624) |
177 | * HC' = ~(~HC + ~m + m') |
178 | */ |
179 | sum = ~ntohs(ip->ip_sum) & 0xffff; |
180 | sum += 0xff00 + (~old & 0xff) + dsfield; |
181 | sum = (sum >> 16) + (sum & 0xffff); |
182 | sum += (sum >> 16); /* add carry */ |
183 | |
184 | ip->ip_sum = htons(~sum & 0xffff); |
185 | } |
186 | #if INET6 |
187 | else if (t->pftag_flags & PF_TAG_HDR_INET6) { |
188 | struct ip6_hdr *ip6 = (struct ip6_hdr *)t->pftag_hdr; |
189 | u_int32_t flowlabel; |
190 | |
191 | if (((uintptr_t)ip6 + sizeof (*ip6)) > |
192 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
193 | return; /* out of bounds */ |
194 | |
195 | flowlabel = ntohl(ip6->ip6_flow); |
196 | if ((flowlabel >> 28) != 6) |
197 | return; /* version mismatch! */ |
198 | flowlabel = (flowlabel & 0xf03fffff) | (dsfield << 20); |
199 | ip6->ip6_flow = htonl(flowlabel); |
200 | } |
201 | #endif |
202 | } |
203 | |
204 | /* |
205 | * try to mark CE bit to the packet. |
206 | * returns 1 if successfully marked, 0 otherwise. |
207 | */ |
208 | int |
209 | mark_ecn(struct mbuf *m, struct pf_mtag *t, int flags) |
210 | { |
211 | struct mbuf *m0; |
212 | void *hdr; |
213 | int af; |
214 | |
215 | if ((hdr = t->pftag_hdr) == NULL || |
216 | !(t->pftag_flags & (PF_TAG_HDR_INET|PF_TAG_HDR_INET6))) |
217 | return (0); |
218 | |
219 | /* verify that hdr is within the mbuf data */ |
220 | for (m0 = m; m0 != NULL; m0 = m0->m_next) |
221 | if (((caddr_t)hdr >= m0->m_data) && |
222 | ((caddr_t)hdr < m0->m_data + m0->m_len)) |
223 | break; |
224 | if (m0 == NULL) { |
225 | /* ick, tag info is stale */ |
226 | printf("%s: can't locate header!\n" , __func__); |
227 | return (0); |
228 | } |
229 | |
230 | if (t->pftag_flags & PF_TAG_HDR_INET) |
231 | af = AF_INET; |
232 | else if (t->pftag_flags & PF_TAG_HDR_INET6) |
233 | af = AF_INET6; |
234 | else |
235 | af = AF_UNSPEC; |
236 | |
237 | switch (af) { |
238 | case AF_INET: |
239 | if (flags & CLASSQF_ECN4) { /* REDF_ECN4 == BLUEF_ECN4 */ |
240 | struct ip *ip = hdr; |
241 | u_int8_t otos; |
242 | int sum; |
243 | |
244 | if (((uintptr_t)ip + sizeof (*ip)) > |
245 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
246 | return (0); /* out of bounds */ |
247 | |
248 | if (ip->ip_v != 4) |
249 | return (0); /* version mismatch! */ |
250 | if ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_NOTECT) |
251 | return (0); /* not-ECT */ |
252 | if ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_CE) |
253 | return (1); /* already marked */ |
254 | |
255 | /* |
256 | * ecn-capable but not marked, |
257 | * mark CE and update checksum |
258 | */ |
259 | otos = ip->ip_tos; |
260 | ip->ip_tos |= IPTOS_ECN_CE; |
261 | /* |
262 | * update checksum (from RFC1624) only if hw |
263 | * checksum is not supported. |
264 | * HC' = ~(~HC + ~m + m') |
265 | */ |
266 | if (!(m->m_pkthdr.csum_flags & CSUM_DELAY_IP)) { |
267 | sum = ~ntohs(ip->ip_sum) & 0xffff; |
268 | sum += (~otos & 0xffff) + ip->ip_tos; |
269 | sum = (sum >> 16) + (sum & 0xffff); |
270 | sum += (sum >> 16); /* add carry */ |
271 | ip->ip_sum = htons(~sum & 0xffff); |
272 | } |
273 | return (1); |
274 | } |
275 | break; |
276 | #if INET6 |
277 | case AF_INET6: |
278 | if (flags & CLASSQF_ECN6) { /* REDF_ECN6 == BLUEF_ECN6 */ |
279 | struct ip6_hdr *ip6 = hdr; |
280 | u_int32_t flowlabel; |
281 | |
282 | if (((uintptr_t)ip6 + sizeof (*ip6)) > |
283 | ((uintptr_t)mbuf_datastart(m0) + mbuf_maxlen(m0))) |
284 | return (0); /* out of bounds */ |
285 | |
286 | flowlabel = ntohl(ip6->ip6_flow); |
287 | if ((flowlabel >> 28) != 6) |
288 | return (0); /* version mismatch! */ |
289 | if ((flowlabel & (IPTOS_ECN_MASK << 20)) == |
290 | (IPTOS_ECN_NOTECT << 20)) |
291 | return (0); /* not-ECT */ |
292 | if ((flowlabel & (IPTOS_ECN_MASK << 20)) == |
293 | (IPTOS_ECN_CE << 20)) |
294 | return (1); /* already marked */ |
295 | /* |
296 | * ecn-capable but not marked, mark CE |
297 | */ |
298 | flowlabel |= (IPTOS_ECN_CE << 20); |
299 | ip6->ip6_flow = htonl(flowlabel); |
300 | return (1); |
301 | } |
302 | break; |
303 | #endif /* INET6 */ |
304 | } |
305 | |
306 | /* not marked */ |
307 | return (0); |
308 | } |
309 | #endif /* PF_ECN */ |
310 | |