nf_conntrack_seqadj.c 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. #include <linux/types.h>
  3. #include <linux/netfilter.h>
  4. #include <net/tcp.h>
  5. #include <net/netfilter/nf_conntrack.h>
  6. #include <net/netfilter/nf_conntrack_extend.h>
  7. #include <net/netfilter/nf_conntrack_seqadj.h>
  8. int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
  9. s32 off)
  10. {
  11. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  12. struct nf_conn_seqadj *seqadj;
  13. struct nf_ct_seqadj *this_way;
  14. if (off == 0)
  15. return 0;
  16. set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
  17. seqadj = nfct_seqadj(ct);
  18. this_way = &seqadj->seq[dir];
  19. this_way->offset_before = off;
  20. this_way->offset_after = off;
  21. return 0;
  22. }
  23. EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);
  24. int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
  25. __be32 seq, s32 off)
  26. {
  27. struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
  28. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  29. struct nf_ct_seqadj *this_way;
  30. if (off == 0)
  31. return 0;
  32. if (unlikely(!seqadj)) {
  33. WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n");
  34. return 0;
  35. }
  36. set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
  37. spin_lock_bh(&ct->lock);
  38. this_way = &seqadj->seq[dir];
  39. if (this_way->offset_before == this_way->offset_after ||
  40. before(this_way->correction_pos, ntohl(seq))) {
  41. this_way->correction_pos = ntohl(seq);
  42. this_way->offset_before = this_way->offset_after;
  43. this_way->offset_after += off;
  44. }
  45. spin_unlock_bh(&ct->lock);
  46. return 0;
  47. }
  48. EXPORT_SYMBOL_GPL(nf_ct_seqadj_set);
  49. void nf_ct_tcp_seqadj_set(struct sk_buff *skb,
  50. struct nf_conn *ct, enum ip_conntrack_info ctinfo,
  51. s32 off)
  52. {
  53. const struct tcphdr *th;
  54. if (nf_ct_protonum(ct) != IPPROTO_TCP)
  55. return;
  56. th = (struct tcphdr *)(skb_network_header(skb) + ip_hdrlen(skb));
  57. nf_ct_seqadj_set(ct, ctinfo, th->seq, off);
  58. }
  59. EXPORT_SYMBOL_GPL(nf_ct_tcp_seqadj_set);
  60. /* Adjust one found SACK option including checksum correction */
  61. static void nf_ct_sack_block_adjust(struct sk_buff *skb,
  62. struct tcphdr *tcph,
  63. unsigned int sackoff,
  64. unsigned int sackend,
  65. struct nf_ct_seqadj *seq)
  66. {
  67. while (sackoff < sackend) {
  68. struct tcp_sack_block_wire *sack;
  69. __be32 new_start_seq, new_end_seq;
  70. sack = (void *)skb->data + sackoff;
  71. if (after(ntohl(sack->start_seq) - seq->offset_before,
  72. seq->correction_pos))
  73. new_start_seq = htonl(ntohl(sack->start_seq) -
  74. seq->offset_after);
  75. else
  76. new_start_seq = htonl(ntohl(sack->start_seq) -
  77. seq->offset_before);
  78. if (after(ntohl(sack->end_seq) - seq->offset_before,
  79. seq->correction_pos))
  80. new_end_seq = htonl(ntohl(sack->end_seq) -
  81. seq->offset_after);
  82. else
  83. new_end_seq = htonl(ntohl(sack->end_seq) -
  84. seq->offset_before);
  85. pr_debug("sack_adjust: start_seq: %u->%u, end_seq: %u->%u\n",
  86. ntohl(sack->start_seq), ntohl(new_start_seq),
  87. ntohl(sack->end_seq), ntohl(new_end_seq));
  88. inet_proto_csum_replace4(&tcph->check, skb,
  89. sack->start_seq, new_start_seq, false);
  90. inet_proto_csum_replace4(&tcph->check, skb,
  91. sack->end_seq, new_end_seq, false);
  92. sack->start_seq = new_start_seq;
  93. sack->end_seq = new_end_seq;
  94. sackoff += sizeof(*sack);
  95. }
  96. }
  97. /* TCP SACK sequence number adjustment */
  98. static unsigned int nf_ct_sack_adjust(struct sk_buff *skb,
  99. unsigned int protoff,
  100. struct nf_conn *ct,
  101. enum ip_conntrack_info ctinfo)
  102. {
  103. struct tcphdr *tcph = (void *)skb->data + protoff;
  104. struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
  105. unsigned int dir, optoff, optend;
  106. optoff = protoff + sizeof(struct tcphdr);
  107. optend = protoff + tcph->doff * 4;
  108. if (skb_ensure_writable(skb, optend))
  109. return 0;
  110. tcph = (void *)skb->data + protoff;
  111. dir = CTINFO2DIR(ctinfo);
  112. while (optoff < optend) {
  113. /* Usually: option, length. */
  114. unsigned char *op = skb->data + optoff;
  115. switch (op[0]) {
  116. case TCPOPT_EOL:
  117. return 1;
  118. case TCPOPT_NOP:
  119. optoff++;
  120. continue;
  121. default:
  122. /* no partial options */
  123. if (optoff + 1 == optend ||
  124. optoff + op[1] > optend ||
  125. op[1] < 2)
  126. return 0;
  127. if (op[0] == TCPOPT_SACK &&
  128. op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
  129. ((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
  130. nf_ct_sack_block_adjust(skb, tcph, optoff + 2,
  131. optoff+op[1],
  132. &seqadj->seq[!dir]);
  133. optoff += op[1];
  134. }
  135. }
  136. return 1;
  137. }
  138. /* TCP sequence number adjustment. Returns 1 on success, 0 on failure */
  139. int nf_ct_seq_adjust(struct sk_buff *skb,
  140. struct nf_conn *ct, enum ip_conntrack_info ctinfo,
  141. unsigned int protoff)
  142. {
  143. enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
  144. struct tcphdr *tcph;
  145. __be32 newseq, newack;
  146. s32 seqoff, ackoff;
  147. struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
  148. struct nf_ct_seqadj *this_way, *other_way;
  149. int res = 1;
  150. this_way = &seqadj->seq[dir];
  151. other_way = &seqadj->seq[!dir];
  152. if (skb_ensure_writable(skb, protoff + sizeof(*tcph)))
  153. return 0;
  154. tcph = (void *)skb->data + protoff;
  155. spin_lock_bh(&ct->lock);
  156. if (after(ntohl(tcph->seq), this_way->correction_pos))
  157. seqoff = this_way->offset_after;
  158. else
  159. seqoff = this_way->offset_before;
  160. newseq = htonl(ntohl(tcph->seq) + seqoff);
  161. inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, false);
  162. pr_debug("Adjusting sequence number from %u->%u\n",
  163. ntohl(tcph->seq), ntohl(newseq));
  164. tcph->seq = newseq;
  165. if (!tcph->ack)
  166. goto out;
  167. if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
  168. other_way->correction_pos))
  169. ackoff = other_way->offset_after;
  170. else
  171. ackoff = other_way->offset_before;
  172. newack = htonl(ntohl(tcph->ack_seq) - ackoff);
  173. inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack,
  174. false);
  175. pr_debug("Adjusting ack number from %u->%u, ack from %u->%u\n",
  176. ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
  177. ntohl(newack));
  178. tcph->ack_seq = newack;
  179. res = nf_ct_sack_adjust(skb, protoff, ct, ctinfo);
  180. out:
  181. spin_unlock_bh(&ct->lock);
  182. return res;
  183. }
  184. EXPORT_SYMBOL_GPL(nf_ct_seq_adjust);
  185. s32 nf_ct_seq_offset(const struct nf_conn *ct,
  186. enum ip_conntrack_dir dir,
  187. u32 seq)
  188. {
  189. struct nf_conn_seqadj *seqadj = nfct_seqadj(ct);
  190. struct nf_ct_seqadj *this_way;
  191. if (!seqadj)
  192. return 0;
  193. this_way = &seqadj->seq[dir];
  194. return after(seq, this_way->correction_pos) ?
  195. this_way->offset_after : this_way->offset_before;
  196. }
  197. EXPORT_SYMBOL_GPL(nf_ct_seq_offset);
  198. static const struct nf_ct_ext_type nf_ct_seqadj_extend = {
  199. .len = sizeof(struct nf_conn_seqadj),
  200. .align = __alignof__(struct nf_conn_seqadj),
  201. .id = NF_CT_EXT_SEQADJ,
  202. };
  203. int nf_conntrack_seqadj_init(void)
  204. {
  205. return nf_ct_extend_register(&nf_ct_seqadj_extend);
  206. }
  207. void nf_conntrack_seqadj_fini(void)
  208. {
  209. nf_ct_extend_unregister(&nf_ct_seqadj_extend);
  210. }